PT-2022-4763 · Google · Android Kernel

Published 2022-06-06 · Updated 2025-02-11 · CVE-2022-20186

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android kernel

Description The issue is related to improper input validation in the kbase mem alias function of mali kbase mem linux.c, which could lead to arbitrary code execution and local escalation of privilege without requiring additional execution privileges. User interaction is not needed for exploitation. The vulnerability allows mapping arbitrary physical pages to the GPU memory with both read and write access, enabling arbitrary kernel code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-05663

CVE-2022-20186

Affected Products

Android Kernel

References · 13

• 🔥 https://github.com/Bariskizilkaya/CVE-2022-20186_CTXZ · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-20186 · Security Note
• https://bdu.fstec.ru/vul/2022-05663 · Security Note
• https://source.android.com/security/bulletin/pixel/2022-06-01 · Vendor Advisory
• https://github.com/jbaines-r7/overkill · Note
• https://t.me/cybersecuritytechnologies/6487 · Telegram Post
• https://twitter.com/javierprtd/status/1889354131514564727 · Twitter Post
• https://t.me/linkersec/178 · Telegram Post
• https://t.me/pentestingnews/26279 · Telegram Post
• https://twitter.com/rohithcdac/status/1757260265606058382 · Twitter Post
• https://t.me/poxek/2467 · Telegram Post
• https://t.me/cibsecurity/44526 · Telegram Post
• http://packetstormsecurity.com/files/172852/Android-Arm-Mali-GPU-Arbitrary-Code-Execution.html · Note