PT-2022-14452 · Google · Android

Published 2022-07-01 · Updated 2022-07-25 · CVE-2022-20228

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions Android-12 through Android-12L

Description In various functions of C2DmaBufAllocator.cpp, there is a possible memory corruption due to a use after free. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

Recommendations For Android versions Android-12 through Android-12L, update to a version that includes the fix for the memory corruption issue in C2DmaBufAllocator.cpp. As a temporary workaround, consider restricting access to the functions in C2DmaBufAllocator.cpp that are prone to the use after free vulnerability until a patch is available.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ASB-A-213850092

CVE-2022-20228

Affected Products

Android

References · 8

• https://osv.dev/vulnerability/CVE-2022-20228 · Vendor Advisory
• https://source.android.com/security/bulletin/2022-07-01 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-213850092 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20228 · Security Note
• https://android.googlesource.com/platform/frameworks/av/+/a12f8a065c081b7aa2d7aaa1df79498c282c53d2 · Note
• https://t.me/cvenotify/33011 · Telegram Post
• https://t.me/cvenotify/33725 · Telegram Post
• https://t.me/cibsecurity/46195 · Telegram Post