Use-after-free in Pixel - CVE-2022-20566

Vulnerability identifier: #VU72526

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-20566

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the l2cap_chan_put() function in Bluetooth L2CAP implementation. A local application can trigger a use-after-free error and execute arbitrary code with elevated privileges.

Pixel
Anolis OS
Ubuntu
openEuler
linux-image-aws (Ubuntu package)
linux-image-4.4.0-1154-aws (Ubuntu package)
linux-image-4.4.0-1116-aws (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-generic-lts-xenial (Ubuntu package)
linux-image-virtual-lts-xenial (Ubuntu package)
linux-image-4.4.0-237-lowlatency (Ubuntu package)
linux-image-4.4.0-1117-kvm (Ubuntu package)
linux-image-4.4.0-237-generic (Ubuntu package)
linux-image-lowlatency-lts-xenial (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-generic (Ubuntu package)
bpftool
python2-perf-debuginfo
kernel-tools
kernel-devel
kernel-debuginfo
python2-perf
python3-perf-debuginfo
kernel-tools-devel
kernel-tools-debuginfo
kernel-source
perf
bpftool-debuginfo
perf-debuginfo
kernel-debugsource
kernel
python3-perf
kernel-debug
kernel-core
python-perf
kernel-tools-libs-devel
kernel-tools-libs
kernel-headers
kernel-debug-devel
kernel-debug-core
kernel-debug-modules
kernel-debug-modules-extra
kernel-modules
kernel-modules-extra
kernel-modules-internal
linux-image-oem-20.04 (Ubuntu package)
linux-image-oem-20.04d (Ubuntu package)
linux-image-oem-20.04b (Ubuntu package)
linux-image-oem-20.04c (Ubuntu package)
linux-image-5.14.0-1058-oem (Ubuntu package)
linux-image-oem-22.04a (Ubuntu package)
linux-image-oem-22.04 (Ubuntu package)
linux-image-5.17.0-1028-oem (Ubuntu package)

Install updates from vendor's website.

Pixel - update to 2022-12-05
linux-image-aws (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-4.4.0-1154-aws (Ubuntu package) - update to Ubuntu Pro
linux-image-4.4.0-1116-aws (Ubuntu package) - update to Ubuntu Pro
linux-image-lowlatency (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-kvm (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-generic-lts-xenial (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-virtual-lts-xenial (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-4.4.0-237-lowlatency (Ubuntu package) - update to Ubuntu Pro
linux-image-4.4.0-1117-kvm (Ubuntu package) - update to Ubuntu Pro
linux-image-4.4.0-237-generic (Ubuntu package) - update to Ubuntu Pro
linux-image-lowlatency-lts-xenial (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-virtual (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-generic (Ubuntu package) - update to Ubuntu Pro (Infra-only)
bpftool - addressed in versions 4.19.90-2212.3.0.0182, 5.10.0-60.74.0.98
python2-perf-debuginfo - update to 4.19.90-2212.3.0.0182
kernel-tools - addressed in versions 4.19.90-2212.3.0.0182, 5.10.0-60.74.0.98
kernel-devel - addressed in versions 4.19.90-2212.3.0.0182, 5.10.0-60.74.0.98
kernel-debuginfo - addressed in versions 4.19.90-2212.3.0.0182, 5.10.0-60.74.0.98
python2-perf - update to 4.19.90-2212.3.0.0182
python3-perf-debuginfo - addressed in versions 4.19.90-2212.3.0.0182, 5.10.0-60.74.0.98
kernel-tools-devel - addressed in versions 4.19.90-2212.3.0.0182, 5.10.0-60.74.0.98
kernel-tools-debuginfo - addressed in versions 4.19.90-2212.3.0.0182, 5.10.0-60.74.0.98
kernel-source - addressed in versions 4.19.90-2212.3.0.0182, 5.10.0-60.74.0.98
perf - addressed in versions 4.19.90-2212.3.0.0182, 5.10.0-60.74.0.98
bpftool-debuginfo - addressed in versions 4.19.90-2212.3.0.0182, 5.10.0-60.74.0.98
perf-debuginfo - addressed in versions 4.19.90-2212.3.0.0182, 5.10.0-60.74.0.98
kernel-debugsource - addressed in versions 4.19.90-2212.3.0.0182, 5.10.0-60.74.0.98
kernel - addressed in versions 4.19.90-2212.3.0.0182, 5.10.0-60.74.0.98
python3-perf - addressed in versions 4.19.90-2212.3.0.0182, 5.10.0-60.74.0.98
kernel-debug - addressed in versions 4.19.91-27.2, 4.19.91-28
kernel-core - addressed in versions 4.19.91-27.2, 4.19.91-28
kernel - addressed in versions 4.19.91-27.2, 4.19.91-28
bpftool - addressed in versions 4.19.91-27.2, 4.19.91-28
python-perf - addressed in versions 4.19.91-27.2, 4.19.91-28
perf - addressed in versions 4.19.91-27.2, 4.19.91-28
kernel-tools-libs-devel - addressed in versions 4.19.91-27.2, 4.19.91-28
kernel-tools-libs - addressed in versions 4.19.91-27.2, 4.19.91-28
kernel-tools - addressed in versions 4.19.91-27.2, 4.19.91-28
kernel-headers - addressed in versions 4.19.91-27.2, 4.19.91-28
kernel-devel - addressed in versions 4.19.91-27.2, 4.19.91-28
kernel-debug-devel - addressed in versions 4.19.91-27.2, 4.19.91-28
kernel-debug-core - addressed in versions 4.19.91-27.2, 4.19.91-28
kernel-debug-modules - addressed in versions 4.19.91-27.2, 4.19.91-28
kernel-debug-modules-extra - addressed in versions 4.19.91-27.2, 4.19.91-28
kernel-modules - addressed in versions 4.19.91-27.2, 4.19.91-28
kernel-modules-extra - addressed in versions 4.19.91-27.2, 4.19.91-28
kernel-modules-internal - addressed in versions 4.19.91-27.2, 4.19.91-28
python3-perf - addressed in versions 4.19.91-27.2, 4.19.91-28
kernel-headers - update to 5.10.0-60.74.0.98
linux-image-oem-20.04 (Ubuntu package) - update to 5.14.0.1058.56
linux-image-oem-20.04d (Ubuntu package) - update to 5.14.0.1058.56
linux-image-oem-20.04b (Ubuntu package) - update to 5.14.0.1058.56
linux-image-oem-20.04c (Ubuntu package) - update to 5.14.0.1058.56
linux-image-5.14.0-1058-oem (Ubuntu package) - update to 5.14.0-1058.66
linux-image-oem-22.04a (Ubuntu package) - update to 5.17.0.1028.26
linux-image-oem-22.04 (Ubuntu package) - update to 5.17.0.1028.26
linux-image-5.17.0-1028-oem (Ubuntu package) - update to 5.17.0-1028.29

• https://source.android.com/docs/security/bulletin/pixel/2022-12-01
• https://android.googlesource.com/kernel/common/+/cacbff013baa586c63dd779e67d13238bf46c28e
• https://android.googlesource.com/kernel/common/+/2f9fed9ce805cf4d97cffb2f59d57b41b8e7fca8

• Ubuntu update for linux-aws
• Ubuntu update for linux-oem-5.14
• Ubuntu update for linux
• Multiple vulnerabilities in Google Pixel (December 2022)
• openEuler update for kernel
• openEuler 22.03 LTS update for kernel
• Anolis OS update for kernel
• Anolis OS update for kernel
• Anolis OS update for kernel
• Anolis OS update for kernel