PT-2022-14683 · Google · Android Kernel

Published 2022-10-14 · Updated 2022-10-15 · CVE-2022-20464

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android kernel

Description The issue is caused by a logic error in the code of ap input processor.c, allowing for the potential recording of audio during a phone call. This could lead to local information disclosure, with user execution privileges required for exploitation. No user interaction is needed for exploitation.

Recommendations For Android kernel, consider restricting access to sensitive audio functions until a patch is available. As a temporary workaround, disabling the affected functions in ap input processor.c may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2022-20464

Affected Products

Android Kernel

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2022-20464 · Security Note
• https://source.android.com/security/bulletin/pixel/2022-10-01 · Vendor Advisory
• https://t.me/cibsecurity/51450 · Telegram Post