CVE-2022-20145 Security feature bypass in Android
A protocol downgrade attack in Android's VPN service allows remote attackers to retrieve credentials and escalate privileges via a malicious Wi-Fi access point.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-20145?
CVE-2022-20145 is a critical vulnerability in Google Android, published on 15 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In startLegacyVpnPrivileged of Vpn.java, there is a possible way to retrieve VPN credentials due to a protocol downgrade attack. This could lead to remote escalation of privilege if a malicious Wi-Fi AP is used, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-201660636
Which versions are affected by CVE-2022-20145?
It affects 1 product.
Products include Google Android.
How do I fix CVE-2022-20145?
Apply the vendor's patch.
Is CVE-2022-20145 being exploited?
There is no known exploitation of CVE-2022-20145 in the wild and no public exploit code.
Other vulnerabilities in Google Android
Sources
Also known as A-201660636, ASB-A-201660636, GHSA-9q4r-5p5v-23xq.