CVE-2022-20486

What it actually does

Failure to persist permissions settings in NotificationChannel due to resource exhaustion, enabling local privilege escalation on Android without additional privileges or user interaction.

Why it matters to the business

Local attackers can gain elevated system privileges on affected devices, increasing risk of data compromise or unauthorized control; low exploit probability but widespread device exposure across versions 10-13.

How an attack unfolds

An attacker with local access on a vulnerable Android device triggers resource exhaustion targeting NotificationChannel.java, causing permission settings to fail to persist and resulting in unauthorized privilege escalation.

How to fix it

Apply Android security updates for versions 10 through 13; for listed MediaWiki packages upgrade to fixed versions such as 1:1.35.8-1~deb11u1 on Debian 11, 1:1.35.7-1 on Debian 12/13, or commit 1d62ca6ec30099e7e9d6c554693a4b8e88e91139 in wikimedia/mediawiki.

How to confirm the fix worked

Verify Android patch level includes fix for A-242703118; confirm MediaWiki package versions match the listed fixed releases via package manager or git commit checks.

Typical attack path

1. Gain local access to the Android device
2. Trigger resource exhaustion condition in NotificationChannel
3. Exploit failure of permissions to persist
4. Escalate to higher privileges locally

How to detect it

Review system logs for resource exhaustion events related to notifications or permission persistence failures; examine process activity for unexpected privilege changes post-exhaustion.

What your security team should do

• Prioritize patching Android devices to latest security updates
• Update MediaWiki instances to specified fixed package versions
• Monitor for local privilege escalation attempts on endpoints