CVE-2022-20166: Linux Kernel Android Package - 2 Byte Buffer Overflow in wakeup_stats.c
Summary
CVE-2022-20166: In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer overflow. Affects :linux_kernel: versions >= :0, < :2022-06-05. Fixed in :2022-06-05. How to fix ↓
Also tracked for
- linux · Debian:11
The same CVE-2022-20166 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Android operating system, responsible for managing hardware resources and providing essential services to applications. It is designed to be efficient, secure, and flexible, supporting a wide range of devices. However, vulnerabilities can arise due to complex interactions within the kernel, leading to potential security risks.
Vulnerability Detail
The vulnerability identified as CVE-2022-20166 is a 2 byte buffer overflow occurring in the name_show() function of wakeup_stats.c. This issue arises from improper handling of memory allocation in various kernel base drivers, which can lead to an out-of-bounds write. The consequence of this vulnerability is a local escalation of privilege, requiring system execution privileges for exploitation. Notably, user interaction is not necessary for an attacker to exploit this vulnerability, making it a significant security concern.
How To Fix
Minimum fixed version
:2022-06-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the fix by updating the kernel as described above.
Conclusion
CVE-2022-20166 represents a significant security vulnerability within the Linux Kernel used in Android systems. The 2 byte buffer overflow can lead to serious security implications, including local privilege escalation. Users are strongly advised to update their kernel to the fixed version to protect against potential exploitation.
See every vulnerability recorded for :linux_kernel: →
FAQ
CVE-2022-20166 is a vulnerability in the Linux Kernel that allows for a 2 byte buffer overflow, potentially leading to local escalation of privileges.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The primary risk is local escalation of privilege, which could allow an attacker to gain unauthorized access to system resources and execute malicious actions.
No, user interaction is not needed for exploitation, making this vulnerability particularly dangerous.
While there are no specific workarounds, it is crucial to prioritize updating your kernel as soon as possible to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for :linux_kernel:.
