CVE-2022-20121

Name of the Vulnerable Software and Affected Versions Android kernel

Description The issue is related to a missing permission check in the USCCDMPlugin.java file, specifically in the getNodeValue method. This could lead to the disclosure of ICCID, resulting in local information disclosure. No additional execution privileges are required for exploitation, and user interaction is not necessary.

Recommendations For Android kernel, consider implementing a permission check in the getNodeValue method of USCCDMPlugin.java to prevent unauthorized access to sensitive information. As a temporary workaround, restrict access to the USCCDMPlugin.java module to minimize the risk of exploitation.