PT-2022-3192 · Google · Android

Published 2022-03-08 · Updated 2022-06-23 · CVE-2022-20127

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android versions Android-10 through Android-12L

Description The issue is related to a possible out of bounds write due to a double free in the ce t4t data cback function. This could lead to remote code execution with no additional execution privileges needed. User interaction is not required for exploitation.

Recommendations For Android versions Android-10 through Android-12L, update to a version that includes a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Double Free

Weakness Enumeration

CWE-787

CWE-415

Related Identifiers

ASB-A-221862119

BDU:2022-03876

CVE-2022-20127

Affected Products

Android

References · 10

• https://osv.dev/vulnerability/ASB-A-221862119 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20127 · Security Note
• https://source.android.com/security/bulletin/2022-06-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03876 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20127 · Vendor Advisory
• https://t.me/true_secator/3038 · Telegram Post
• https://anti-malware.ru/news/2022-06-07-111332/38847 · Note
• https://t.me/cibsecurity/44493 · Telegram Post
• https://github.com/advisories/GHSA-v2rr-ww6m-w47m · Note
• https://android.googlesource.com/platform/system/nfc/+/2fcf7d677bcebae5a00db43938460bcce267149e · Note