Cyber Resilience

CVE-2022-20421

High

Published: 11 October 2022

Published
11 October 2022
Modified
21 November 2024
KEV Added
Patch
01 October 2022
CVSS Score v3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0586 90.8th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-20421 is a high-severity Use After Free (CWE-416) vulnerability in Debian Debian Linux. Its CVSS base score is 7.8 (High).

Operationally, ranked in the top 9.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

The vulnerability CVE-2022-20421 is a use-after-free flaw in the binder_inc_ref_for_node function of binder.c within the Android kernel. It can produce memory corruption and is tracked under Android ID A-239630375, carrying a CVSS score of 7.8 and classified as CWE-416.

A local attacker can trigger the issue without any additional privileges or user interaction, resulting in privilege escalation on an affected device.

Public advisories point to the October 2022 Android security bulletin and corresponding Debian updates (DSA-5257 and LTS announcements) as the sources for patches that address the kernel component.

EPSS values have stayed low, with a current score of 0.0586 and a recorded peak of 0.0646.

EU & UK References

Vulnerability details

In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:…

more

Android kernelAndroid ID: A-239630375References: Upstream kernel

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

google
android
all versions
debian
debian linux
10.0, 11.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-416

Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.

References