CVE-2022-20368

Published: 11 August 2022

Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel

From the Ubuntu Security Team

It was discovered that the Packet network protocol implementation in the Linux kernel contained an out-of-bounds access. A remote attacker could use this to expose sensitive information (kernel memory).

Notes

Originally, there was confusion that the same commit
appeared to fix CVE-2022-20158 as well as this CVE, but the
information in the other CVE has been corrected.
according to SUSE, the commit b2cf86e1563e ("packet: in
recvmsg msg_name return at least sizeof sockaddr_ll") may also be needed
for older kernels

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20368
• https://git.kernel.org/linus/c700525fcc06b05adfea78039de02628af79e07a (5.17)
• https://ubuntu.com/security/notices/USN-5580-1
• https://ubuntu.com/security/notices/USN-5650-1
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.suse.com/show_bug.cgi?id=1202346