CVE-2022-20154
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In lock_sock_nested in sock.c, a use-after-free is possible due to a race condition. This could lead to local privilege escalation with System execution privileges needed, without user interaction.
Risk Assessment
The vulnerability may allow an attacker with system privileges to escalate privileges in the Android kernel, potentially leading to full system compromise.
Recommendation
Apply upstream kernel patches and update Android to a patched version.
Other vulnerabilities in Android kernel
See all- CVE-2017-13174High
CVE-2017-13174 is a privilege escalation vulnerability in the Android kernel. It affects Android kernel versions and may allow unauthorized access to system resources.
- CVE-2017-13168High
CVE-2017-13168 is a privilege escalation vulnerability in the Android kernel SCSI driver. It affects the Android kernel in versions related to Android ID A-65023233.
- CVE-2017-13167High
CVE-2017-13167 describes an elevation of privilege vulnerability in the kernel sound timer of Android. It affects the Android kernel in versions that do not include patches.
- CVE-2017-13164High
An information disclosure vulnerability in the kernel binder driver of Android. It affects the Android kernel and may lead to unauthorized access to sensitive data.
- CVE-2017-13163High
CVE-2017-13163 is a privilege escalation vulnerability in the MTP USB driver in the Android kernel. It affects Android kernel versions.
- CVE-2017-13162High
CVE-2017-13162 is a privilege escalation vulnerability in the Android kernel, which may allow unauthorized access to system resources.
- CVE-2017-0864High
CVE-2017-0864 is a privilege escalation vulnerability in the MediaTek ioctl (flashlight) in Android. It affects the Android kernel.
- CVE-2017-0862High
CVE-2017-0862 is a privilege escalation vulnerability in the Android kernel. It affects unspecified versions of the Android kernel.
- CVE-2017-0794High
CVE-2017-0794 is a privilege escalation vulnerability in the Upstream kernel SCSI driver. It affects the Android operating system and its kernel.
- CVE-2017-0750High
An elevation of privilege vulnerability in the Upstream Linux file system. It affects Android kernels.
Original NVD description (English source)
In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream kernel
Vulnerability data from NVD (NIST) · CISA KEV · EPSS