PT-2022-14815 · Google · Android Kernel

Published 2022-12-16 · Updated 2022-12-21 · CVE-2022-20607

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android kernel

Description The issue is related to a missing bounds check in the Pixel cellular firmware, which could lead to an out of bounds write. This might result in remote code execution, with LTE authentication required for exploitation. No user interaction is needed for this issue to be exploited.

Recommendations For Android kernel, apply the necessary patch or update to fix the missing bounds check issue. As a temporary workaround, consider restricting access to the LTE authentication mechanism until a patch is available.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2022-20607

Affected Products

Android Kernel

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2022-20607 · Security Note
• https://source.android.com/security/bulletin/pixel/2022-12-01 · Vendor Advisory
• https://t.me/cvenotify/40335 · Telegram Post