CVE-2022-20487

What it actually does

Resource exhaustion in NotificationChannel.java prevents permission settings from being persisted, allowing a local process to retain or gain elevated privileges without user interaction.

Why it matters to the business

Devices running affected Android versions could be compromised by malicious apps already installed, leading to unauthorized access to user data and system capabilities with minimal attacker effort.

How an attack unfolds

An attacker installs or controls a local app that triggers repeated resource exhaustion conditions against the notification subsystem, causing permission changes to be lost and thereby maintaining or escalating privileges on the device.

How to fix it

Update affected Android devices to the latest vendor-provided security patch that resolves the resource-exhaustion condition in NotificationChannel handling.

How to confirm the fix worked

Confirm the device is running a patched Android build; review source history for NotificationChannel.java changes addressing persistence under exhaustion; test permission changes under simulated resource pressure.

Typical attack path

1. Obtain local execution via installed application or adb access
2. Trigger resource exhaustion in the NotificationChannel handling code
3. Perform permission modification operations that fail to persist
4. Retain or obtain elevated capabilities without further user interaction

How to detect it

Review Android system logs and notification subsystem traces for repeated resource-exhaustion events correlated with permission changes; examine app behavior for unexpected retention of notification-related permissions.

What your security team should do

• Prioritize deployment of Android security updates to all managed devices
• Monitor vendor bulletins for the specific patch addressing A-242703202
• Enforce app-vetting policies to limit unnecessary notification or permission-related privileges