CVE-2022-20567: Use After Free
In pppol2tpcreate of l2tpppp.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
android/:linux_kernel:to a version that resolves this vulnerability.Fixed in :2022-12-05
Event History
Frequently Asked Questions
What is the severity of CVE-2022-20567?
CVE-2022-20567 is classified as a local escalation of privilege vulnerability.
How do I fix CVE-2022-20567?
To mitigate CVE-2022-20567, ensure your Android system or Debian Linux package is updated to the recommended patched versions.
Which versions are affected by CVE-2022-20567?
CVE-2022-20567 affects certain versions of the Android kernel and specific versions of Debian Linux packages.
What could be the impact of CVE-2022-20567?
Exploitation of CVE-2022-20567 could lead to unauthorized local escalation of privileges.
Is user interaction required for CVE-2022-20567 exploitation?
No, user interaction is not needed for the exploitation of CVE-2022-20567.