CVE-2022-20409
Published: 11 October 2022
Summary
CVE-2022-20409 is a medium-severity Use After Free (CWE-416) vulnerability in Google Android. Its CVSS base score is 6.7 (Medium).
Operationally, ranked in the top 9.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-20409 is a use-after-free vulnerability in the io_identity_cow function within io_uring.c of the Linux kernel, which can result in memory corruption. The issue affects the Android kernel and is tracked under Android ID A-238177383; it was disclosed on 2022-10-11 with a CVSS score of 6.7 and is classified under CWE-416.
An attacker with existing system execution privileges can exploit the flaw locally without user interaction to achieve memory corruption, potentially leading to further privilege escalation on the device. The attack vector is local and requires high privileges, limiting its reach to processes already running with elevated access.
Upstream fixes are referenced in Android's October 2022 security bulletin and corresponding kernel commits that address the io_uring use-after-free condition. The EPSS score has remained low and stable near 0.056, indicating limited observed exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-25669
Vulnerability details
In io_identity_cow of io_uring.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android…
more
kernelAndroid ID: A-238177383References: Upstream kernel
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.