Improper input validation in Pixel - CVE-2022-20568

Vulnerability identifier: #VU74691

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-20568

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation within the io_uring subcomponent in Kernel components. A local application can execute arbitrary code.

Pixel
openEuler
kernel
python3-perf-debuginfo
kernel-tools-devel
kernel-tools-debuginfo
kernel-source
perf
bpftool-debuginfo
python3-perf
perf-debuginfo
kernel-debugsource
python2-perf-debuginfo
kernel-tools
kernel-devel
kernel-debuginfo
bpftool
python2-perf
kernel-headers

Install security update from vendor's website.

Pixel - update to 2022-12-05
kernel - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
python3-perf-debuginfo - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
kernel-tools-devel - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
kernel-tools-debuginfo - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
kernel-source - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
perf - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
bpftool-debuginfo - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
python3-perf - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
perf-debuginfo - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
kernel-debugsource - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
python2-perf-debuginfo - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183
kernel-tools - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
kernel-devel - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
kernel-debuginfo - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
bpftool - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
python2-perf - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183
kernel-headers - update to 5.10.0-60.74.0.98

• https://android.googlesource.com/kernel/common/+/bc80ea8a4296c4d75f7e3e27b65718cae09f20f1
• https://source.android.com/docs/security/bulletin/pixel/2022-12-01

• Multiple vulnerabilities in Google Pixel (December 2022)
• openEuler 20.03 LTS SP1 update for kernel
• openEuler 20.03 LTS SP3 update for kernel
• openEuler 22.03 LTS update for kernel