CVE-2022-20154

Description

In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream kernel

CVSS Metrics

• v4.0•HIGH•Score: 7.3CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
• v3.1•MEDIUM•Score: 6.4CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
• v2.0•MEDIUM•Score: 4.4AV:L/AC:M/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 0.11%• Percentile: 1%

Techniques & Countermeasures

• CWE-362•Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Affected Systems

• debian•linux

  < 5.10.92-1 | < 5.15.15-1 | < 5.15.15-1 | < 5.15.15-1

• ubuntu•linux

  < 4.15.0-173.182 | < 5.4.0-105.119

• ubuntu•linux-aws

  < 4.15.0-1124.133 | < 5.4.0-1069.73

• ubuntu•linux-aws-5.0

  all

• ubuntu•linux-aws-5.11

  all

• ubuntu•linux-aws-5.13

  all

• ubuntu•linux-aws-5.3

  all

• ubuntu•linux-aws-5.4

  < 5.4.0-1069.73~18.04.1

• ubuntu•linux-aws-5.8

  all

• ubuntu•linux-aws-fips

  < 4.15.0-2064.67 | all | < 5.4.0-1069.73+fips2

• ubuntu•linux-aws-hwe

  < 4.15.0-1124.133~16.04.1

• ubuntu•linux-azure

  < 4.15.0-1134.147~14.04.1 | < 4.15.0-1134.147~16.04.1 | all | < 5.4.0-1073.76

• ubuntu•linux-azure-4.15

  < 4.15.0-1134.147

• ubuntu•linux-azure-5.11

  all

• ubuntu•linux-azure-5.13

  all

• ubuntu•linux-azure-5.3

  all

• ubuntu•linux-azure-5.4

  < 5.4.0-1073.76~18.04.1

• ubuntu•linux-azure-5.8

  all

• ubuntu•linux-azure-edge

  all

• ubuntu•linux-azure-fips

  < 4.15.0-2046.50 | all | < 5.4.0-1073.76+fips1

• ubuntu•linux-bluefield

  all | < 5.4.0-1032.35

• ubuntu•linux-dell300x

  < 4.15.0-1038.43

• ubuntu•linux-fips

  < 4.15.0-1081.90 | all | < 5.4.0-1046.52

• ubuntu•linux-gcp

  < 4.15.0-1119.133~16.04.1 | all | < 5.4.0-1068.72

• ubuntu•linux-gcp-4.15

  < 4.15.0-1119.133

• ubuntu•linux-gcp-5.11

  all

• ubuntu•linux-gcp-5.13

  all

• ubuntu•linux-gcp-5.3

  all

• ubuntu•linux-gcp-5.4

  < 5.4.0-1068.72~18.04.1

• ubuntu•linux-gcp-5.8

  all

• ubuntu•linux-gcp-fips

  < 4.15.0-2029.32 | all | < 5.4.0-1067.71~20.04.1

• ubuntu•linux-gke

  < 5.4.0-1066.69

• ubuntu•linux-gke-4.15

  all

• ubuntu•linux-gke-5.4

  < 5.4.0-1066.69~18.04.1

• ubuntu•linux-gkeop

  < 5.4.0-1037.38

• ubuntu•linux-gkeop-5.4

  < 5.4.0-1037.38~18.04.1

• ubuntu•linux-hwe

  < 4.15.0-173.182~16.04.1 | all

• ubuntu•linux-hwe-5.11

  all

• ubuntu•linux-hwe-5.13

  all

• ubuntu•linux-hwe-5.4

  < 5.4.0-105.119~18.04.1

• ubuntu•linux-hwe-5.8

  all

• ubuntu•linux-hwe-edge

  all | all

• ubuntu•linux-ibm

  < 5.4.0-1018.20

• ubuntu•linux-ibm-5.4

  < 5.4.0-1018.20~18.04.1

• ubuntu•linux-intel-5.13

  all

• ubuntu•linux-intel-iot-realtime

  all

• ubuntu•linux-kvm

  < 4.15.0-1110.113 | < 5.4.0-1059.62

• ubuntu•linux-oem

  all

• ubuntu•linux-oem-5.10

  all

• ubuntu•linux-oem-5.13

  all

Showing first 50 affected entries in server-rendered view.

References (5)

• https://source.android.com/security/bulletin/pixel/2022-06-01
• https://ubuntu.com/security/CVE-2022-20154
• https://git.kernel.org/linus/5ec7d18d1813a5bead0b495045606c93873aecbb
• https://www.cve.org/CVERecord?id=CVE-2022-20154
• https://security-tracker.debian.org/tracker/CVE-2022-20154