CVE-2022-20479

What it actually does

Failure to persist permissions settings in NotificationChannel.java due to resource exhaustion enabling local privilege escalation on Android without additional privileges or user interaction.

Why it matters to the business

Local attackers could gain elevated access on affected Android versions 10-13, risking data compromise and system control on devices; low ongoing EPSS and no KEV status after 1405 days suggest limited active threat but patches should still be applied where relevant.

How an attack unfolds

An attacker with local access triggers resource exhaustion in NotificationChannel to prevent permission settings from persisting, resulting in unauthorized privilege escalation on the device.

How to fix it

Apply the listed fixes for gitlab-org/gitlab including commits af6735ad95ff7a4578c8548d37ce9e8247385d5e and 81f47cb467e3387cea11b909ea6b977e28b3b4d2; for Android devices ensure updates to patched versions beyond Android-13.

How to confirm the fix worked

Confirm updated commits or Android versions are deployed and test permission persistence behavior under resource load conditions.

Typical attack path

1. Obtain local access on the target Android device
2. Induce resource exhaustion affecting NotificationChannel
3. Cause permissions settings to fail to persist
4. Escalate privileges locally without further interaction

How to detect it

Review system logs for notification channel errors or permission persistence failures under high resource usage; check for unexpected privilege changes in local processes.

What your security team should do

• Prioritize patching affected Android deployments despite low EPSS
• Review local access controls to limit privilege escalation vectors
• Monitor for similar resource exhaustion issues in notification subsystems