PT-2022-3961 · Google · Android

Published 2022-07-06 · Updated 2022-07-26 · CVE-2022-20238

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android versions prior to the fixed version

Description The issue is related to the implementation of the remap pfn range() function in the Android operating system kernel, which can lead to a buffer overflow in memory when processing the vma->vm page prot parameter. This can allow a remote attacker to cause a denial of service. The remap pfn range() function may map out of size kernel memory, and because the vma->vm page prot can also be controlled by userspace, userspace may map the kernel area to be writable, making it easy to be exploited.

Recommendations As a temporary workaround, consider restricting access to the remap pfn range() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2022-04794

CVE-2022-20238

Affected Products

Android

References · 5

• https://source.android.com/security/bulletin/2022-07-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20238 · Security Note
• https://bdu.fstec.ru/vul/2022-04794 · Security Note
• https://t.me/cvenotify/33006 · Telegram Post
• https://t.me/cibsecurity/46177 · Telegram Post