PT-2022-14570 · Google · Android

Published 2022-08-01 · Updated 2025-10-20 · CVE-2022-20345

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions Android-12 through Android-12L

Description In the l2cble process sig cmd function of l2c ble.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.

Recommendations For Android versions Android-12 through Android-12L, update to the latest security patch level, which includes the fixes for this issue. As a temporary workaround, consider disabling Bluetooth functionality until the update is applied. Restrict access to the l2cble process sig cmd function to minimize the risk of exploitation.

Fix

RCE

Memory Corruption

Command Injection

Weakness Enumeration

CWE-787

CWE-77

Related Identifiers

ASB-A-230494481

CVE-2022-20345

Affected Products

Android

References · 10

• https://osv.dev/vulnerability/ASB-A-230494481 · Vendor Advisory
• https://source.android.com/security/bulletin/2022-08-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20345 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20345 · Vendor Advisory
• https://android.googlesource.com/platform/system/bt/+/e0dd01b536919d5407968eae341b72fa10ec0b7d · Note
• https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0b7fe01dd050fa4155b1cd802d901b4c9eccdfef · Note
• https://t.me/true_secator/3248 · Telegram Post
• https://t.me/cibsecurity/47890 · Telegram Post
• https://t.me/poxek/2320 · Telegram Post
• https://t.me/cveNotify/139479 · Telegram Post