VDB
CVE-2022-20607
CVE-2022-20607
PUBLISHED
Es existieren mehrere Schwachstellen in Google Android. Die Fehler bestehen in den Komponenten Framework, Media Framework, System, Google Play System Updates, Kernel, Imagination Technologies, MediaTek, Unisoc, Qualcomm, Qualcomm closed-source und Pixel. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, einen Denial-of-Service-Zustand zu verursachen, beliebigen Code auszuführen und vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.
EPSS 6.10% · 90.9th percentile
Risk Scores
EPSS Score
6.10%
90.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Google Android 12L | ||
| Google Android 11 | ||
| Google Android 13 | ||
| Google Android 12 | ||
| Google Android 10 | ||
| SUSE | SUSE Linux |
Exploit Intelligence
- In the Pixel cellular firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with LTE authentication needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238914868References: N/A CVE project by @Sn0wAlice (github-poc)
- In the Pixel cellular firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with LTE authentication needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238914868References: N/A CVE project by @Sn0wAlice (github-poc)
- In the Pixel cellular firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with LTE authentication needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238914868References: N/A CVE project by @Sn0wAlice (github-poc)
- In the Pixel cellular firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with LTE authentication needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238914868References: N/A CVE project by @Sn0wAlice (github-poc)
- In the Pixel cellular firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with LTE authentication needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238914868References: N/A CVE project by @Sn0wAlice (github-poc)
- CIRCL published-proof-of-concept: CVE-2022-20607 (circl-sighting)
- CIRCL published-proof-of-concept: CVE-2022-20607 (circl-sighting)
- CIRCL seen: CVE-2022-20607 (circl-sighting)
- https://source.android.com/security/bulletin/pixel/2022-12-01 (circl)
Timeline
- Dec 5, 2022 CVE Published
- Dec 17, 2022 EPSS Score
- Dec 22, 2022 PoC Published
- Jan 28, 2023 EPSS Score
- Jan 29, 2023 PoC Published
- Mar 7, 2023 EPSS Score
- Apr 10, 2023 CVE Updated
- Apr 21, 2023 EPSS Score
- Jun 2, 2023 EPSS Score
- Aug 24, 2023 EPSS Score
- Nov 16, 2023 EPSS Score
- Dec 28, 2023 EPSS Score
References
- https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-2234.json advisory
- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-2234 advisory
- https://lists.suse.com/pipermail/sle-security-updates/2023-April/014437.html advisory
- https://source.android.com/docs/security/bulletin/2022-12-01 advisory
- https://source.android.com/docs/security/bulletin/pixel/2022-12-01 advisory