CVE-2022-20476

What it actually does

Local resource exhaustion in PackageManager.setEnabledSetting triggers an infinite reboot loop without requiring additional privileges or user interaction.

Why it matters to the business

Devices become unusable through repeated forced restarts, causing operational downtime and loss of availability for end users.

How an attack unfolds

An attacker with local access invokes the vulnerable setting function to exhaust system resources, forcing the device into a persistent reboot cycle.

How to fix it

Apply the fixed version lua/lua (GIT) commit 42d40581dd919fb134c07027ca1ce0844c670daf or later.

How to confirm the fix worked

Confirm the updated commit is present in the package manager source and test that repeated setting changes no longer cause reboot loops.

Typical attack path

1. Obtain local access on the device
2. Invoke setEnabledSetting to trigger resource exhaustion
3. Force repeated reboots resulting in denial of service

How to detect it

Review system logs for repeated PackageManager calls followed by reboot events and resource exhaustion indicators.

What your security team should do

• Prioritize patching affected Android versions 10 through 12L to the fixed commit
• Monitor device availability metrics for unexpected reboot patterns
• Apply updates within standard maintenance windows given the low EPSS and absence from KEV