Permissions, Privileges, and Access Controls in Google Android - CVE-2022-20433

Vulnerability identifier: #VU67877

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-20433

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to unspecified error in UNISOC Telephony component. A local application can execute arbitrary code with elevated privileges.

Google Android
SC9863A
SC9832E
SC7731E
T610
T310
T606
T760
T618
T612
T616
T770
T820
S8000

Install updates from vendor's website.

Google Android - addressed in versions 10 2022-10-05, 11 2022-10-05, 12L 2022-10-05, 12 2022-10-05, 13 2022-10-05

• https://source.android.com/docs/security/bulletin/2022-10-01#2022-10-05-security-patch-level-vulnerability-details

• Multiple vulnerabilities in Google Android
• Multiple vulnerabilities in Unisoc chipsets