CVE-2022-20233

In param_find_digests_internal and related functions of the Titan-M source, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-222472803References: N/A

• CVE ID
• CVE-2022-20233

• Assigner
• security@android.com

• Vulnerability Status
• Analyzed

• Published Version
• 2022-06-15T14:15:13

• Last Modified Date
• 2022-06-24T03:28:17

• Version
• 2.0

• Vector String
• AV:L/AC:L/Au:N/C:C/I:C/A:C

• Access Vector
• LOCAL

• Access Compatibility
• LOW

• Authentication
• NONE

• Confidentiality Impact
• COMPLETE

• Integrity Impact
• COMPLETE

• Availability Impact
• COMPLETE

• Base Score
• 7.2

• Severity
• HIGH

• Exploitability Score
• 3.9

• Impact Score
• 10

• Version
• 3.1

• Vector String
• CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

• Attack Vector
• LOCAL

• Attack Compatibility
• LOW

• Privileges Required
• HIGH

• User Interaction
• NONE

• Scope
• UNCHANGED

• Confidentiality Impact
• HIGH

• Availability Impact
• HIGH

• Base Score
• 6.7

• Base Severity
• MEDIUM

• Exploitability Score
• 0.8

• Impact Score
• 5.9