CVE-2022-21745: Use After Free
In WIFI Firmware, there is a possible memory corruption due to a use after free. This could lead to remote code execution, when devices are connecting to the attacker-controllable Wi-Fi hotspot, with no additional execution privileges needed. User interaction is not needed for exploitation.
Other sources
In WIFI Firmware, there is a possible memory corruption due to a use after free. This could lead to remote escalation of privilege, when devices are connecting to the attacker-controllable Wi-Fi hotspot, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06468872; Issue ID: ALPS06468872.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/:unknown:to a version that resolves this vulnerability.Fixed in SoCVersion:2022-06-05 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ALPS06468872
Event History
Frequently Asked Questions
What is CVE-2022-21745?
CVE-2022-21745 is a vulnerability in WIFI Firmware that can lead to remote escalation of privilege.
How does CVE-2022-21745 occur?
CVE-2022-21745 occurs due to a memory corruption issue caused by a use after free vulnerability.
How severe is CVE-2022-21745?
CVE-2022-21745 has a severity rating of 8.8 (high).
Which devices are affected by CVE-2022-21745?
Devices running Google Android versions 10.0, 11.0, and 12.0 are affected by CVE-2022-21745.
How can I fix CVE-2022-21745?
To fix CVE-2022-21745, apply the security patches and updates provided by the vendor.