PT-2022-14381 · Google · Android Kernel

Published 2022-06-15 · Updated 2022-06-23 · CVE-2022-20146

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android kernel

Description The issue is related to a possible incorrect file access due to a confused deputy in the uploadFile method of FileUploadServiceImpl.java. This could lead to local information disclosure of private files with no additional execution privileges needed. User interaction is not required for exploitation.

Recommendations For Android kernel, consider restricting access to sensitive files until a patch is available. As a temporary workaround, review file access permissions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2022-20146

Affected Products

Android Kernel

References · 3

• https://source.android.com/security/bulletin/pixel/2022-06-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20146 · Security Note
• https://t.me/cibsecurity/44508 · Telegram Post