CVE-2022-20409

In io_identity_cow of io_uring.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238177383References: Upstream kernel

CVSS v3.1

6.7 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.59% chance of exploitation in the next 30 days, 46th percentile

Published

2022-10-11

Updated

2024-08-03

Proof-of-concept exploits (2)

• Markakd/DirtyCred591★ · 2023-11-10
• Markakd/bad_io_uring213★ · 2024-10-17

References

• CVE Record
• NVD entry

Related

• CVE-2021-3715
• CVE-2021-4154
• CVE-2022-2588
• CVE-2022-2040
• CVE-2022-2041
• CVE-2022-2037