PT-2022-7032 · Google+1 · Android Kernel+1

Published 2022-03-16 · Updated 2022-06-23 · CVE-2022-20148

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android kernel versions (affected versions not specified)

Description The issue is related to a possible use-after-free due to a race condition in the Android kernel. This could lead to local escalation of privilege in the kernel, with System execution privileges needed. User interaction is not required for exploitation. The vulnerability is associated with synchronization errors when using a shared resource.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Race Condition

Weakness Enumeration

CWE-416

CWE-362

Related Identifiers

BDU:2023-07192

CVE-2022-20148

Affected Products

Android Kernel

Astra Linux

References · 14

• https://bdu.fstec.ru/vul/2023-07192 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-20148 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-20148 · Security Note
• https://source.android.com/security/bulletin/pixel/2022-06-01 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-20148 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-20148 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-20148 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-20148 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20148 · Security Note
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.7 · Note
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.3 · Note
• https://android.googlesource.com/kernel/common/+/591f4296cc0ec · Note
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.19 · Note
• https://android.googlesource.com/kernel/common/+/528611246fcbd · Note