PT-2022-14766 · Google · Android

Published 2022-12-16 · Updated 2022-12-20 · CVE-2022-20554

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions Android-13

Description The issue is related to a possible out-of-bounds (OOB) read due to a use after free in the removeEventHubDevice function of InputDevice.cpp. This could lead to local escalation of privilege, requiring System execution privileges. No user interaction is needed for exploitation.

Recommendations For Android version Android-13, consider restricting access to the removeEventHubDevice function in InputDevice.cpp to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2022-20554

Affected Products

Android

References · 4

• https://osv.dev/vulnerability/CVE-2022-20554 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20554 · Security Note
• https://source.android.com/security/bulletin/pixel/2022-12-01 · Vendor Advisory
• https://t.me/cibsecurity/54733 · Telegram Post