PT-2022-14625 · Google · Android Kernel

Published 2022-09-13 · Updated 2022-09-17 · CVE-2022-20399

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android kernel

Description The issue is related to the SEPolicy configuration of system apps, which allows access to the 'ip' utility due to an insecure default value. This could lead to local information disclosure of network data without requiring additional execution privileges. User interaction is not necessary for exploitation.

Recommendations For Android kernel, consider restricting access to the 'ip' utility as a temporary workaround until a patch is available.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2022-20399

Affected Products

Android Kernel

References · 2

• https://source.android.com/security/bulletin/2022-09-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20399 · Security Note