CVE-2022-20474

CVE-2022-20474分析——LazyValue下の自己変更Bundle はじめに 注意事項として、本記事を読む前にBundle Mismatch関連の脆弱性について基本的な理解があることを前提とします。以下の参考資料をまだ読んでいない場合は、先に読むことをお勧めします： 1. Bundle风水——Androidシリアライズとデシリアライズの不一致脆弱性詳解：古典的な入門向けチュートリアル。 2. Android デシリアライズ脆弱性攻防史：優れた総括記事。 3. TheLastBundleMismatch：LazyValueモードにおけるBundle Mismatchの最初の記事...

Exploit for Incorrect Default Permissions in Google Android

CVE-2022-20474 Analysis - Self-changed Bundle under LazyValue...

ASB-A-240138318

In initializeFromParcelLocked of BaseBundle.java, there is a possible method arbitrary code execution due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

XStream: Unsafe deserizaliation of sun.swing.SwingLazyValue

A flaw was found in xstream. A remote attacker can load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...