CVE-2022-20559 in Android
Summary
by MITRE • 12/16/2022
In revokeOwnPermissionsOnKill of PermissionManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-219739967
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/22/2026
The vulnerability identified as CVE-2022-20559 resides within the Android operating system's PermissionManager.java component, specifically in the revokeOwnPermissionsOnKill method. This flaw represents a side channel information disclosure vulnerability that allows adversaries to determine whether specific applications are installed on a device without requiring explicit permission queries or additional execution privileges. The vulnerability stems from the way the system handles permission revocation processes when applications are terminated, creating an observable timing or behavioral pattern that can be exploited to infer application presence.
The technical implementation of this vulnerability involves the PermissionManager component's handling of permission revocation during application termination scenarios. When an application is killed, the system processes permission revocation in a manner that inadvertently exposes information about the application's installation status through timing variations or other observable side channels. This occurs because the permission management system does not properly account for the difference between applications that exist and those that have been uninstalled when processing the kill signal and subsequent permission revocation. The vulnerability specifically affects Android 13 and is tracked under Android ID A-219739967.
The operational impact of this vulnerability extends beyond simple information disclosure, as it provides attackers with a method to enumerate installed applications on a device without requiring user interaction or additional privileges. This capability can be leveraged for various malicious purposes including targeted attacks, reconnaissance, and fingerprinting of device configurations. The vulnerability is particularly concerning because it operates at the system level within the permission management framework, making it difficult to detect and mitigate through standard application-level security measures. Attackers could potentially use this information to tailor more sophisticated attacks or to identify specific applications that may contain vulnerabilities or that are of particular interest for exploitation.
This vulnerability aligns with CWE-203: "Information Exposure Through Sent Data" and represents a classic example of how system-level operations can inadvertently expose sensitive information through side channels. From an ATT&CK framework perspective, this vulnerability maps to T1082: "System Information Discovery" and T1592: "Get Access" as it enables adversaries to gather information about installed applications and potentially gain access to additional system resources. The lack of user interaction requirements and the minimal privilege escalation needed make this vulnerability particularly attractive to threat actors seeking to establish persistent access or conduct reconnaissance activities. Mitigation efforts should focus on ensuring that permission management operations properly handle all application states and do not expose information about application existence through timing variations or other observable side channels, requiring updates to the Android permission management system to prevent such information leakage during normal system operations.