Race condition in Google Android - CVE-2022-20421

 

Race condition in Google Android - CVE-2022-20421

Published: October 4, 2022 / Updated: May 21, 2023


Vulnerability identifier: #VU67865
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-20421
CWE-ID: CWE-362
Exploitation vector: Local access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a race condition within the Binder driver in Android kernel in drivers/android/binder.c. A local application can exploit the race to trigger a use-after-free error and execute arbitrary code with elevated privileges.


Affected software

Google Android
Debian Linux
Ubuntu
Slackware Linux
openEuler
SIMATIC S7-1500 TM MFP - BIOS
linux-image-azure (Ubuntu package)
linux-image-lowlatency-hwe-16.04 (Ubuntu package)
linux-image-oem (Ubuntu package)
linux-image-4.15.0-1147-aws-hwe (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-aws-hwe (Ubuntu package)
linux-image-generic-hwe-16.04 (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-virtual-hwe-16.04 (Ubuntu package)
linux-image-4.15.0-201-generic (Ubuntu package)
linux-image-4.15.0-1112-oracle (Ubuntu package)
linux-image-4.15.0-201-lowlatency (Ubuntu package)
linux-image-4.15.0-1158-azure (Ubuntu package)
linux-image-4.15.0-1142-gcp (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-4.15.0-201-generic-lpae (Ubuntu package)
linux-image-dell300x (Ubuntu package)
linux-image-4.15.0-1058-dell300x (Ubuntu package)
linux-image-oracle-lts-18.04 (Ubuntu package)
linux-image-raspi2 (Ubuntu package)
linux-image-4.15.0-1125-raspi2 (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-4.15.0-1133-kvm (Ubuntu package)
linux-image-gcp-lts-18.04 (Ubuntu package)
linux-image-snapdragon (Ubuntu package)
linux-image-4.15.0-1143-snapdragon (Ubuntu package)
linux-image-aws-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1147-aws (Ubuntu package)
linux-image-azure-lts-18.04 (Ubuntu package)
kernel
perf
perf-debuginfo
kernel-tools-debuginfo
python3-perf-debuginfo
kernel-debugsource
bpftool
kernel-tools-devel
kernel-debuginfo
kernel-source
python2-perf-debuginfo
bpftool-debuginfo
kernel-devel
kernel-tools
python2-perf
python3-perf
linux-image-oem-osp1 (Ubuntu package)
linux-image-5.4.0-136-lowlatency (Ubuntu package)
linux-image-5.4.0-136-generic (Ubuntu package)
linux-image-5.4.0-136-generic-lpae (Ubuntu package)
linux-image-lowlatency-hwe-18.04 (Ubuntu package)
linux-image-virtual-hwe-18.04 (Ubuntu package)
linux-image-generic-lpae-hwe-18.04 (Ubuntu package)
linux-image-generic-hwe-18.04 (Ubuntu package)
linux-image-snapdragon-hwe-18.04 (Ubuntu package)
linux-image-5.4.0-1041-ibm (Ubuntu package)
linux-image-ibm (Ubuntu package)
linux-image-ibm-lts-20.04 (Ubuntu package)
linux-image-bluefield (Ubuntu package)
linux-image-5.4.0-1054-bluefield (Ubuntu package)
linux-image-gkeop-5.4 (Ubuntu package)
linux-image-gkeop (Ubuntu package)
linux-image-5.4.0-1061-gkeop (Ubuntu package)
linux-image-raspi-hwe-18.04 (Ubuntu package)
linux-image-5.4.0-1078-raspi (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-5.4.0-1083-kvm (Ubuntu package)
linux-image-oracle-lts-20.04 (Ubuntu package)
linux-image-gke-5.4 (Ubuntu package)
linux-image-5.4.0-1091-gke (Ubuntu package)
linux-image-5.4.0-1091-oracle (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-aws-lts-20.04 (Ubuntu package)
linux-image-5.4.0-1093-aws (Ubuntu package)
linux-image-gcp-lts-20.04 (Ubuntu package)
linux-image-5.4.0-1097-gcp (Ubuntu package)
linux-image-azure-lts-20.04 (Ubuntu package)
linux-image-5.4.0-1100-azure-fde (Ubuntu package)
linux-image-azure-fde (Ubuntu package)
linux-image-5.4.0-1100-azure (Ubuntu package)
kernel-headers
linux (Debian package)
linux-image-lowlatency-hwe-22.04 (Ubuntu package)
linux-image-lowlatency-64k-hwe-22.04 (Ubuntu package)
linux-image-lowlatency-64k (Ubuntu package)
linux-image-virtual-hwe-22.04 (Ubuntu package)
linux-image-generic-lpae-hwe-22.04 (Ubuntu package)
linux-image-generic-hwe-22.04 (Ubuntu package)
linux-image-generic-64k-hwe-22.04 (Ubuntu package)
linux-image-generic-64k (Ubuntu package)
linux-image-5.15.0-57-lowlatency (Ubuntu package)
linux-image-5.15.0-57-generic (Ubuntu package)
linux-image-5.15.0-57-generic-lpae (Ubuntu package)
linux-image-5.15.0-57-generic-64k (Ubuntu package)
linux-image-5.15.0-57-lowlatency-64k (Ubuntu package)
linux-image-generic-64k-hwe-20.04 (Ubuntu package)
linux-image-virtual-hwe-20.04 (Ubuntu package)
linux-image-generic-hwe-20.04 (Ubuntu package)
linux-image-generic-lpae-hwe-20.04 (Ubuntu package)
linux-image-gkeop-5.15 (Ubuntu package)
linux-image-5.15.0-1012-gkeop (Ubuntu package)
linux-image-raspi-nolpae (Ubuntu package)
linux-image-5.15.0-1022-raspi (Ubuntu package)
linux-image-5.15.0-1022-raspi-nolpae (Ubuntu package)
linux-image-5.15.0-1022-ibm (Ubuntu package)
linux-image-gke-5.15 (Ubuntu package)
linux-image-5.15.0-1024-gke (Ubuntu package)
linux-image-5.15.0-1025-kvm (Ubuntu package)
linux-image-5.15.0-1026-oracle (Ubuntu package)
linux-image-5.15.0-1026-gcp (Ubuntu package)
linux-image-aws-lts-22.04 (Ubuntu package)
linux-image-5.15.0-1027-aws (Ubuntu package)
linux-image-5.15.0-1027-gke (Ubuntu package)
linux-image-azure-lts-22.04 (Ubuntu package)
linux-image-5.15.0-1030-azure (Ubuntu package)
linux-image-5.15.0-1030-azure-fde (Ubuntu package)
linux-5.15.80/kernel-modules
linux-5.15.80/kernel-huge
linux-5.15.80/kernel-generic
linux-5.15.80/kernel-headers
linux-image-oem-22.04 (Ubuntu package)
linux-image-5.19.0-28-generic-lpae (Ubuntu package)
linux-image-5.19.0-28-generic (Ubuntu package)
linux-image-5.19.0-28-generic-64k (Ubuntu package)
linux-image-5.19.0-1011-raspi (Ubuntu package)
linux-image-5.19.0-1011-raspi-nolpae (Ubuntu package)
linux-image-5.19.0-1014-lowlatency-64k (Ubuntu package)
linux-image-5.19.0-1014-lowlatency (Ubuntu package)
linux-image-5.19.0-1014-ibm (Ubuntu package)
linux-image-5.19.0-1014-gcp (Ubuntu package)
linux-image-5.19.0-1014-oracle (Ubuntu package)
linux-image-5.19.0-1015-kvm (Ubuntu package)
linux-image-5.19.0-1016-azure (Ubuntu package)
linux-image-5.19.0-1016-aws (Ubuntu package)

How to mitigate CVE-2022-20421

Install updates from vendor's website.

Google Android - addressed in versions 10 2022-10-05, 11 2022-10-05, 12L 2022-10-05, 12 2022-10-05, 13 2022-10-05
linux-image-azure (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 5.4.0.1100.73, 5.15.0.1030.26, 5.15.0.1030.37~20.04.20, 5.19.0.1016.12
linux-image-lowlatency-hwe-16.04 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-oem (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 5.4.0.136.134, 5.4.0.136.153~18.04.111
linux-image-4.15.0-1147-aws-hwe (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-gke (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 5.4.0.1091.96, 5.15.0.1024.23
linux-image-gcp (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 5.4.0.1097.73, 5.15.0.1026.21, 5.19.0.1014.11
linux-image-aws-hwe (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-generic-hwe-16.04 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-oracle (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 5.4.0.1091.100~18.04.65, 5.15.0.1026.21, 5.19.0.1014.11
linux-image-virtual-hwe-16.04 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-4.15.0-201-generic (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 4.15.0-201.212
linux-image-4.15.0-1112-oracle (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 4.15.0-1112.123
linux-image-4.15.0-201-lowlatency (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 4.15.0-201.212
linux-image-4.15.0-1158-azure (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 4.15.0-1158.173
linux-image-4.15.0-1142-gcp (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 4.15.0-1142.158
linux-image-virtual (Ubuntu package) - addressed in versions 4.15.0.201.184, 5.4.0.136.134, 5.15.0.57.55, 5.19.0.28.25
linux-image-generic (Ubuntu package) - addressed in versions 4.15.0.201.184, 5.4.0.136.134, 5.15.0.57.55, 5.19.0.28.25
linux-image-lowlatency (Ubuntu package) - addressed in versions 4.15.0.201.184, 5.4.0.136.134, 5.15.0.57.50, 5.19.0.1014.11
linux-image-generic-lpae (Ubuntu package) - addressed in versions 4.15.0.201.184, 5.4.0.136.134, 5.15.0.57.55, 5.19.0.28.25
linux-image-4.15.0-201-generic-lpae (Ubuntu package) - update to 4.15.0-201.212
linux-image-dell300x (Ubuntu package) - update to 4.15.0.1058.57
linux-image-4.15.0-1058-dell300x (Ubuntu package) - update to 4.15.0-1058.63
linux-image-oracle-lts-18.04 (Ubuntu package) - update to 4.15.0.1112.117
linux-image-raspi2 (Ubuntu package) - addressed in versions 4.15.0.1125.120, 5.4.0.1078.108
linux-image-4.15.0-1125-raspi2 (Ubuntu package) - update to 4.15.0-1125.133
linux-image-kvm (Ubuntu package) - addressed in versions 4.15.0.1133.124, 5.4.0.1083.77, 5.15.0.1025.21, 5.19.0.1015.12
linux-image-4.15.0-1133-kvm (Ubuntu package) - update to 4.15.0-1133.138
linux-image-gcp-lts-18.04 (Ubuntu package) - update to 4.15.0.1142.156
linux-image-snapdragon (Ubuntu package) - update to 4.15.0.1143.142
linux-image-4.15.0-1143-snapdragon (Ubuntu package) - update to 4.15.0-1143.153
linux-image-aws-lts-18.04 (Ubuntu package) - update to 4.15.0.1147.145
linux-image-4.15.0-1147-aws (Ubuntu package) - update to 4.15.0-1147.159
linux-image-azure-lts-18.04 (Ubuntu package) - update to 4.15.0.1158.126
kernel - addressed in versions 4.19.90-2210.3.0.0172, 5.10.0-60.61.0.88
perf - addressed in versions 4.19.90-2210.3.0.0172, 5.10.0-60.61.0.88
perf-debuginfo - addressed in versions 4.19.90-2210.3.0.0172, 5.10.0-60.61.0.88
kernel-tools-debuginfo - addressed in versions 4.19.90-2210.3.0.0172, 5.10.0-60.61.0.88
python3-perf-debuginfo - addressed in versions 4.19.90-2210.3.0.0172, 5.10.0-60.61.0.88
kernel-debugsource - addressed in versions 4.19.90-2210.3.0.0172, 5.10.0-60.61.0.88
bpftool - addressed in versions 4.19.90-2210.3.0.0172, 5.10.0-60.61.0.88
kernel-tools-devel - addressed in versions 4.19.90-2210.3.0.0172, 5.10.0-60.61.0.88
kernel-debuginfo - addressed in versions 4.19.90-2210.3.0.0172, 5.10.0-60.61.0.88
kernel-source - addressed in versions 4.19.90-2210.3.0.0172, 5.10.0-60.61.0.88
python2-perf-debuginfo - update to 4.19.90-2210.3.0.0172
bpftool-debuginfo - addressed in versions 4.19.90-2210.3.0.0172, 5.10.0-60.61.0.88
kernel-devel - addressed in versions 4.19.90-2210.3.0.0172, 5.10.0-60.61.0.88
kernel-tools - addressed in versions 4.19.90-2210.3.0.0172, 5.10.0-60.61.0.88
python2-perf - update to 4.19.90-2210.3.0.0172
python3-perf - addressed in versions 4.19.90-2210.3.0.0172, 5.10.0-60.61.0.88
linux-image-oem-osp1 (Ubuntu package) - addressed in versions 5.4.0.136.134, 5.4.0.136.153~18.04.111
linux-image-5.4.0-136-lowlatency (Ubuntu package) - update to 5.4.0-136.153~18.04.1
linux-image-5.4.0-136-generic (Ubuntu package) - update to 5.4.0-136.153~18.04.1
linux-image-5.4.0-136-generic-lpae (Ubuntu package) - update to 5.4.0-136.153~18.04.1
linux-image-lowlatency-hwe-18.04 (Ubuntu package) - update to 5.4.0.136.153~18.04.111
linux-image-virtual-hwe-18.04 (Ubuntu package) - update to 5.4.0.136.153~18.04.111
linux-image-generic-lpae-hwe-18.04 (Ubuntu package) - update to 5.4.0.136.153~18.04.111
linux-image-generic-hwe-18.04 (Ubuntu package) - update to 5.4.0.136.153~18.04.111
linux-image-snapdragon-hwe-18.04 (Ubuntu package) - update to 5.4.0.136.153~18.04.111
linux-image-5.4.0-1041-ibm (Ubuntu package) - update to 5.4.0-1041.46~18.04.1
linux-image-ibm (Ubuntu package) - addressed in versions 5.4.0.1041.52, 5.4.0.1041.67, 5.15.0.1022.18, 5.19.0.1014.11
linux-image-ibm-lts-20.04 (Ubuntu package) - update to 5.4.0.1041.67
linux-image-bluefield (Ubuntu package) - update to 5.4.0.1054.50
linux-image-5.4.0-1054-bluefield (Ubuntu package) - update to 5.4.0-1054.60
linux-image-gkeop-5.4 (Ubuntu package) - update to 5.4.0.1061.59
linux-image-gkeop (Ubuntu package) - addressed in versions 5.4.0.1061.59, 5.15.0.1012.11
linux-image-5.4.0-1061-gkeop (Ubuntu package) - update to 5.4.0-1061.65
linux-image-raspi-hwe-18.04 (Ubuntu package) - update to 5.4.0.1078.75
linux-image-5.4.0-1078-raspi (Ubuntu package) - update to 5.4.0-1078.89~18.04.1
linux-image-raspi (Ubuntu package) - addressed in versions 5.4.0.1078.108, 5.15.0.1022.19, 5.19.0.1011.10
linux-image-5.4.0-1083-kvm (Ubuntu package) - update to 5.4.0-1083.89
linux-image-oracle-lts-20.04 (Ubuntu package) - update to 5.4.0.1091.84
linux-image-gke-5.4 (Ubuntu package) - update to 5.4.0.1091.96
linux-image-5.4.0-1091-gke (Ubuntu package) - update to 5.4.0-1091.98
linux-image-5.4.0-1091-oracle (Ubuntu package) - update to 5.4.0-1091.100~18.04.1
linux-image-aws (Ubuntu package) - addressed in versions 5.4.0.1093.71, 5.15.0.1027.25, 5.15.0.1027.31~20.04.16, 5.19.0.1016.13
linux-image-aws-lts-20.04 (Ubuntu package) - update to 5.4.0.1093.90
linux-image-5.4.0-1093-aws (Ubuntu package) - addressed in versions 5.4.0-1093.101, 5.4.0-1093.102~18.04.2
linux-image-gcp-lts-20.04 (Ubuntu package) - update to 5.4.0.1097.99
linux-image-5.4.0-1097-gcp (Ubuntu package) - update to 5.4.0-1097.106~18.04.1
linux-image-azure-lts-20.04 (Ubuntu package) - update to 5.4.0.1100.93
linux-image-5.4.0-1100-azure-fde (Ubuntu package) - update to 5.4.0-1100.106+cvm1.1
linux-image-azure-fde (Ubuntu package) - addressed in versions 5.4.0.1100.106+cvm1.35, 5.15.0.1030.37.7
linux-image-5.4.0-1100-azure (Ubuntu package) - update to 5.4.0-1100.106~18.04.1
kernel-headers - update to 5.10.0-60.61.0.88
linux (Debian package) - update to 5.10.149-1
linux-image-lowlatency-hwe-22.04 (Ubuntu package) - addressed in versions 5.15.0.57.50, 5.19.0.1014.11
linux-image-lowlatency-64k-hwe-22.04 (Ubuntu package) - addressed in versions 5.15.0.57.50, 5.19.0.1014.11
linux-image-lowlatency-64k (Ubuntu package) - addressed in versions 5.15.0.57.50, 5.19.0.1014.11
linux-image-virtual-hwe-22.04 (Ubuntu package) - addressed in versions 5.15.0.57.55, 5.19.0.28.25
linux-image-generic-lpae-hwe-22.04 (Ubuntu package) - addressed in versions 5.15.0.57.55, 5.19.0.28.25
linux-image-generic-hwe-22.04 (Ubuntu package) - addressed in versions 5.15.0.57.55, 5.19.0.28.25
linux-image-generic-64k-hwe-22.04 (Ubuntu package) - addressed in versions 5.15.0.57.55, 5.19.0.28.25
linux-image-generic-64k (Ubuntu package) - addressed in versions 5.15.0.57.55, 5.19.0.28.25
linux-image-5.15.0-57-lowlatency (Ubuntu package) - update to 5.15.0-57.63
linux-image-5.15.0-57-generic (Ubuntu package) - addressed in versions 5.15.0-57.63, 5.15.0-57.63~20.04.1
linux-image-5.15.0-57-generic-lpae (Ubuntu package) - addressed in versions 5.15.0-57.63, 5.15.0-57.63~20.04.1
linux-image-5.15.0-57-generic-64k (Ubuntu package) - addressed in versions 5.15.0-57.63, 5.15.0-57.63~20.04.1
linux-image-5.15.0-57-lowlatency-64k (Ubuntu package) - update to 5.15.0-57.63
linux-image-generic-64k-hwe-20.04 (Ubuntu package) - update to 5.15.0.57.63~20.04.23
linux-image-virtual-hwe-20.04 (Ubuntu package) - update to 5.15.0.57.63~20.04.23
linux-image-generic-hwe-20.04 (Ubuntu package) - update to 5.15.0.57.63~20.04.23
linux-image-generic-lpae-hwe-20.04 (Ubuntu package) - update to 5.15.0.57.63~20.04.23
linux-image-gkeop-5.15 (Ubuntu package) - update to 5.15.0.1012.11
linux-image-5.15.0-1012-gkeop (Ubuntu package) - update to 5.15.0-1012.16
linux-image-raspi-nolpae (Ubuntu package) - addressed in versions 5.15.0.1022.19, 5.19.0.1011.10
linux-image-5.15.0-1022-raspi (Ubuntu package) - update to 5.15.0-1022.24
linux-image-5.15.0-1022-raspi-nolpae (Ubuntu package) - update to 5.15.0-1022.24
linux-image-5.15.0-1022-ibm (Ubuntu package) - update to 5.15.0-1022.25
linux-image-gke-5.15 (Ubuntu package) - addressed in versions 5.15.0.1024.23, 5.15.0.1027.32~20.04.1
linux-image-5.15.0-1024-gke (Ubuntu package) - update to 5.15.0-1024.29
linux-image-5.15.0-1025-kvm (Ubuntu package) - update to 5.15.0-1025.30
linux-image-5.15.0-1026-oracle (Ubuntu package) - update to 5.15.0-1026.32
linux-image-5.15.0-1026-gcp (Ubuntu package) - update to 5.15.0-1026.33
linux-image-aws-lts-22.04 (Ubuntu package) - update to 5.15.0.1027.25
linux-image-5.15.0-1027-aws (Ubuntu package) - addressed in versions 5.15.0-1027.31, 5.15.0-1027.31~20.04.1
linux-image-5.15.0-1027-gke (Ubuntu package) - update to 5.15.0-1027.32~20.04.1
linux-image-azure-lts-22.04 (Ubuntu package) - update to 5.15.0.1030.26
linux-image-5.15.0-1030-azure (Ubuntu package) - addressed in versions 5.15.0-1030.37, 5.15.0-1030.37~20.04.1
linux-image-5.15.0-1030-azure-fde (Ubuntu package) - update to 5.15.0-1030.37.1
linux-5.15.80/kernel-modules - update to 5.15.80
linux-5.15.80/kernel-huge - update to 5.15.80
linux-5.15.80/kernel-generic - update to 5.15.80
linux-5.15.80/kernel-headers - update to 5.15.80_smp
linux-image-oem-22.04 (Ubuntu package) - update to 5.19.0.28.25
linux-image-5.19.0-28-generic-lpae (Ubuntu package) - update to 5.19.0-28.29
linux-image-5.19.0-28-generic (Ubuntu package) - update to 5.19.0-28.29
linux-image-5.19.0-28-generic-64k (Ubuntu package) - update to 5.19.0-28.29
linux-image-5.19.0-1011-raspi (Ubuntu package) - update to 5.19.0-1011.18
linux-image-5.19.0-1011-raspi-nolpae (Ubuntu package) - update to 5.19.0-1011.18
linux-image-5.19.0-1014-lowlatency-64k (Ubuntu package) - update to 5.19.0-1014.15
linux-image-5.19.0-1014-lowlatency (Ubuntu package) - update to 5.19.0-1014.15
linux-image-5.19.0-1014-ibm (Ubuntu package) - update to 5.19.0-1014.15
linux-image-5.19.0-1014-gcp (Ubuntu package) - update to 5.19.0-1014.15
linux-image-5.19.0-1014-oracle (Ubuntu package) - update to 5.19.0-1014.16
linux-image-5.19.0-1015-kvm (Ubuntu package) - update to 5.19.0-1015.16
linux-image-5.19.0-1016-azure (Ubuntu package) - update to 5.19.0-1016.17
linux-image-5.19.0-1016-aws (Ubuntu package) - update to 5.19.0-1016.17

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins