CVE-2022-20480

What it actually does

In NotificationChannel.java, resource exhaustion prevents persistence of permissions settings, enabling local privilege escalation without additional execution privileges or user interaction.

Why it matters to the business

Local attackers can obtain elevated system access on affected devices, risking data exposure and unauthorized control; low exploit likelihood but affects multiple Android versions with high CVSS severity.

How an attack unfolds

An attacker with local access on a vulnerable Android device triggers resource exhaustion conditions in notification channel handling to cause permissions to fail to persist, resulting in privilege escalation.

How to fix it

Upgrade affected Android versions to patched releases; for GitLab instances apply the fix in commit af6735ad95ff7a4578c8548d37ce9e8247385d5e.

How to confirm the fix worked

Verify Android patch level includes the fix for A-241764350; confirm GitLab deployment includes commit af6735ad95ff7a4578c8548d37ce9e8247385d5e and test permission persistence under resource pressure.

Typical attack path

1. Gain local access to the target device
2. Trigger resource exhaustion via crafted notification channel operations
3. Exploit failure to persist permission settings
4. Escalate privileges to perform unauthorized actions

How to detect it

Review Android system logs for notification channel errors coinciding with permission changes or unexpected privilege grants; check for repeated resource exhaustion events in local process activity.

What your security team should do

• Prioritize patching Android devices to latest versions
• Apply the specified GitLab commit if instances are in scope
• Monitor for local privilege escalation attempts in device logs
• Review and restrict local access policies