In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "6750721687830903541387938765679298548", "129728381512143920073312385761700384458", "136290462382097668927891831171427395639", "120423728662642149267013688500226027288" ] }, "id": "PUB-A-234475629-147d63fb", "source": "https://android.googlesource.com/kernel/common/+/678d7a09525c2edb6b2436c1d5a9a0b9292e31d7", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/md/dm-verity-target.c" }, "signature_type": "Line" }, { "digest": { "threshold": 0.9, "line_hashes": [ "101980834836173696207231592808249676659", "206763611688154899365995941677988173469", "96004355582768959731363167358732599836", "244026125455597786919918268467767645320" ] }, "id": "PUB-A-234475629-5db060ca", "source": "https://android.googlesource.com/kernel/common/+/952141fb9237ec54cda66e04622725daae29d273", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/md/dm-verity-target.c" }, "signature_type": "Line" } ], "fixes": [ "https://android.googlesource.com/kernel/common/+/678d7a09525c2edb6b2436c1d5a9a0b9292e31d7", "https://android.googlesource.com/kernel/common/+/952141fb9237ec54cda66e04622725daae29d273" ], "spl": "2022-12-05", "severity": "Moderate", "types": [ "EoP" ] }