PUB-A-234030265

See a problem?
Import Source
https://storage.googleapis.com/android-osv/PUB-A-234030265.json
JSON Data
https://api.osv.dev/v1/vulns/PUB-A-234030265
Aliases
  • A-234030265
  • CVE-2022-20571
Published
2022-12-01T00:00:00Z
Modified
2026-01-23T16:35:08.295761Z
Summary
[none]
Details

In extract_metadata of dm-android-verity.c, there is a possible way to corrupt kernel memory due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / :linux_kernel:

Package

Name
:linux_kernel:

Affected ranges

Type
ECOSYSTEM
Events
Introduced
:0
Fixed
:2022-12-05

Affected versions

Other

Kernel

Ecosystem specific 

{
    "types": [
        "EoP"
    ],
    "spl": "2022-12-05",
    "vanir_signatures": [
        {
            "signature_version": "v1",
            "signature_type": "Line",
            "id": "PUB-A-234030265-78cd1ee7",
            "digest": {
                "line_hashes": [
                    "43333637226151334257252338418709366095",
                    "85145099847236252700600604943492588310",
                    "261493982372989962275557228004560849061",
                    "143388858974708953349836310361204602284",
                    "53055355912584744486549868783119292344",
                    "101338858360341059444055511594453887302",
                    "152241397047631096954652458994620177503",
                    "2410884912029271408058525962777913465",
                    "338327221067136956231394034595193366283",
                    "109405429697477510143640803960923268678",
                    "239431760680267861408215911484414930880",
                    "113485786908021992668113637231176756422",
                    "308898873564854512691811040027443968926",
                    "267471331716797404320403368007895714041",
                    "232295672164360345511814312781872181884",
                    "188511308032534683327967335951312579236"
                ],
                "threshold": 0.9
            },
            "source": "https://android.googlesource.com/kernel/common/+/668e043112528306813bde9213eba6171ce48223",
            "target": {
                "file": "drivers/md/dm-android-verity.c"
            },
            "deprecated": false
        },
        {
            "signature_version": "v1",
            "signature_type": "Function",
            "id": "PUB-A-234030265-7bdac8a8",
            "digest": {
                "length": 4286.0,
                "function_hash": "77016691559962788528988028336526544098"
            },
            "source": "https://android.googlesource.com/kernel/common/+/668e043112528306813bde9213eba6171ce48223",
            "target": {
                "file": "drivers/md/dm-android-verity.c",
                "function": "android_verity_ctr"
            },
            "deprecated": false
        }
    ],
    "fixes": [
        "https://android.googlesource.com/kernel/common/+/668e043112528306813bde9213eba6171ce48223"
    ],
    "severity": "Moderate"
}

Database specific

source

"https://storage.googleapis.com/android-osv/PUB-A-234030265.json"