PT-2022-1361 · Google+4 · Android Kernel+4

Published 2022-02-04 · Updated 2022-10-31 · CVE-2022-20008

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android kernel versions (affected versions not specified)

Description The issue is related to the mmc blk read single function in block.c, which can lead to local information disclosure due to uninitialized data. This could happen when reading from an SD card that triggers errors, with no additional execution privileges needed. User interaction is not required for exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

ASB-A-216481035

BDU:2022-05891

CVE-2022-20008

OESA-2022-1691

OPENSUSE-SU-2022:2177-1

OPENSUSE-SU-2022_2078-1

OPENSUSE-SU-2022_2079-1

OPENSUSE-SU-2022_3693-1

OPENSUSE-SU-2022_3775-1

SUSE-SU-2022:2078-1

SUSE-SU-2022:2079-1

SUSE-SU-2022:2177-1

SUSE-SU-2022:3584-1

SUSE-SU-2022:3587-1

SUSE-SU-2022:3693-1

SUSE-SU-2022:3704-1

SUSE-SU-2022:3775-1

SUSE-SU-2022:3810-1

USN-5415-1

USN-5417-1

Affected Products

Android Kernel

Astra Linux

Linuxmint

Suse

Ubuntu

References · 237

• 🔥 https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19377 · Exploit
• 🔥 https://github.com/randorisec/CVE-2022-1972-infoleak-PoC · Exploit
• 🔥 https://github.com/aels/CVE-2022-2586-LPE · Exploit
• 🔥 https://github.com/sniper404ghostxploit/CVE-2022-2586 · Exploit
• 🔥❌ https://github.com/V4bel/CVE-2022-41218 · Exploit, Deleted
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-20008 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5415-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20241206SE81 · Vendor Advisory
• https://source.android.com/security/bulletin/2022-05-01 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-20008 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5417-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-27223 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:2177-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-20008 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3704-1 · Vendor Advisory