CVE-2022-20183: Android Kernel Driver Vulnerability Leading to Local Privilege Escalation
Summary
CVE-2022-20183: In hypx_create_blob_dmabuf of faceauth_hypx.c, there is a possible out of bounds write due to a missing bounds check. Affects :unknown: versions >= :0, < :2022-06-05. Fixed in :2022-06-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The affected package is part of the Android ecosystem, specifically related to the kernel driver for Pixel 4 devices. This driver is responsible for managing hardware interactions and ensuring secure communication between the operating system and hardware components. The vulnerability arises in the hypx_create_blob_dmabuf function within the faceauth_hypx.c file, which is critical for handling memory buffers securely. Due to its role in system-level operations, any vulnerabilities in this driver can have significant implications for device security and user privacy.
Vulnerability Detail
The vulnerability is characterized by a slab-out-of-bounds write in the hypx_create_blob_dmabuf function. This flaw is due to a missing bounds check, which allows an attacker to write data outside the allocated memory space. The potential ramifications include local escalation of privilege, enabling an attacker to gain system execution privileges without requiring user interaction. This could lead to unauthorized access to sensitive system resources and data, making it a serious security concern.
How To Fix
Minimum fixed version
:2022-06-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available to mitigate this vulnerability without applying the official patch. Users are strongly advised to update their devices as soon as possible to eliminate the risk.
Conclusion
CVE-2022-20183 represents a significant security vulnerability in the Android kernel driver for Pixel 4 devices, allowing for potential local privilege escalation due to a slab-out-of-bounds write. Users are urged to update their devices promptly to mitigate this risk.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2022-20183 is a vulnerability in the Android kernel driver for Pixel 4 devices that allows for a slab-out-of-bounds write, potentially leading to local privilege escalation.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without requiring signup.
The primary risk is local escalation of privilege, which could allow an attacker to gain unauthorized access to system resources and sensitive data.
No, user interaction is not needed for exploitation, making it particularly dangerous.
If you cannot update your device, it is advisable to limit its use for sensitive operations until a fix is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
