PT-2021-7071 · Google · Android Kernel

Published 2021-10-14 · Updated 2022-05-17 · CVE-2022-20117

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android kernel

Description The issue is related to the improper use of cryptographic algorithms, which could lead to local information disclosure without requiring additional execution privileges. User interaction is not necessary for exploitation. This could allow an attacker to decrypt local data encrypted by the system, potentially leading to the exposure of sensitive information.

Recommendations For Android kernel, consider applying security patches or updates that address the improper use of crypto as a mitigation measure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

BDU:2022-03190

CVE-2022-20117

Affected Products

Android Kernel

References · 8

• https://source.android.com/security/bulletin/pixel/2022-05-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03190 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-20117 · Security Note
• https://community.qualys.com/vulnerability-detection-pipeline · Note
• https://kiratas.com/patchday-important-security-updates-for-android-10-11-and-12-released · Note
• https://t.me/true_secator/2920 · Telegram Post
• https://vuldb.com/?id.199449 · Note
• https://t.me/cibsecurity/42296 · Telegram Post