CVE-2022-20158

2022-08-1100:00:00

ubuntu.com

memory corruption

bdi_put

bdi_unregister

local escalation

android kernel

upstream kernel

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

5.1%

JSON

In bdi_put and bdi_unregister of backing-dev.c, there is a possible memory
corruption due to a use after free. This could lead to local escalation of
privilege with System execution privileges needed. User interaction is not
needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
A-182815710References: Upstream kernel

Notes

Author	Note
sbeattie	It seems the android advisory that contains this CVE has been updated to correctly reflect the associated commits with this issue; furthermore, it appears to have been introduced with an android only commit (see lore reference).