CVE-2022-20154: Use After Free

Published Jun 15, 2022

Updated

In locksocknested of sock.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream kernel

Affected Software

1 affected component

Google Android

Event History

Jun 15, 2022

CVE Published

via MITRE·01:18 PM

Data Sourced

via MITRE·01:18 PM

DescriptionWeakness

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Exploitation requires local access and high privileges. No user interaction is required.

What could successful exploitation allow?

A successful exploit could result in local privilege escalation and execution with System privileges, with potential impact to confidentiality, integrity, and availability.

Which component is affected?

The issue is in the Android kernel, specifically a race condition in lock_sock_nested in sock.c that can cause a use-after-free condition.

CVE-2022-20154: Use After Free

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What could successful exploitation allow?

Which component is affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What could successful exploitation allow?

Which component is affected?