PT-2022-6287 · Google+1 · Android Kernel+1

Published 2022-05-25 · Updated 2025-04-21 · CVE-2022-20568

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android kernel

Description The issue is related to a use after free condition that could corrupt kernel memory, potentially leading to local escalation of privilege without requiring additional execution privileges. User interaction is not necessary for exploitation. The problem is also associated with the io statx() function in the fs/io uring.c module of the io uring component in the Linux kernel, which can lead to a denial of service or privilege escalation.

Recommendations For Android kernel, consider applying a patch from the upstream kernel to resolve the issue. As a temporary workaround, consider restricting access to the io uring component until a patch is available. Avoid using the io statx() function in the affected module until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2023-00744

CVE-2022-20568

OESA-2022-2160

OESA-2022-2161

OESA-2022-2162

Affected Products

Android Kernel

Astra Linux

References · 42

• https://nvd.nist.gov/vuln/detail/CVE-2022-47521 · Security Note
• https://osv.dev/vulnerability/OESA-2022-2161 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4378 · Security Note
• https://osv.dev/vulnerability/OESA-2022-2162 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-20568 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-20568 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3108 · Security Note
• https://bdu.fstec.ru/vul/2023-00744 · Security Note
• https://osv.dev/vulnerability/OESA-2022-2160 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3115 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-20568 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3643 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-20568 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-20566 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-4129 · Security Note