PT-2022-3310 · Google · Android

Published 2022-04-04 · Updated 2022-06-24 · CVE-2022-20140

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android versions Android-12 through Android-12L

Description The issue is related to a function read multi rsp in gatt sr.cc, which is associated with an out of bounds write in memory due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not required for exploitation.

Recommendations For Android versions Android-12 through Android-12L, consider restricting access to the read multi rsp function in gatt sr.cc to minimize the risk of exploitation until a patch is available.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ASB-A-227618988

BDU:2022-04056

CVE-2022-20140

Affected Products

Android

References · 8

• https://osv.dev/vulnerability/CVE-2022-20140 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04056 · Security Note
• https://source.android.com/security/bulletin/2022-06-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20140 · Security Note
• https://osv.dev/vulnerability/ASB-A-227618988 · Vendor Advisory
• https://t.me/true_secator/3038 · Telegram Post
• https://android.googlesource.com/platform/system/bt/+/7056e665e7d4782af9474b1645c59afbb2b76efd · Note
• https://t.me/cibsecurity/44515 · Telegram Post