CVE-2022-20238

'remap_pfn_range' here may map out of size kernel memory (for example, may map the kernel area), and because the 'vma->vm_page_prot' can also be controlled by…

published July 13, 2022

CVSS
—
EPSS
1%
Percentile
45.9
In the wild
Unconfirmed
What it is

⚠️ A crafty quirk in memory mapping could let userspace control kernel memory! 🤯 That's right, the potential for a writable kernel area is lurking here! Think of it like a restaurant with a hidden door that leads to the kitchen — if a diner can somehow unlock that door, they might just start changing the recipes, and that could lead to some disastrous results! 🍽️ An attacker could exploit this vulnerability to gain unauthorized access to critical kernel memory, potentially modifying system behavior and compromising device integrity. This could lead to catastrophic outcomes like executing arbitrary code at the kernel level, making the device vulnerable to further attacks.

Put simply

Think of it like a restaurant with a hidden door that leads to the kitchen — if a diner can somehow unlock that door, they might just start changing the recipes, and that could lead to some disastrous results! 🍽️ The vulnerability arises from how 'remap_pfn_range' handles memory mapping, allowing userspace to manipulate 'vma->vm_page_prot' and map writable kernel areas, which shouldn't be possible.

What to do

An attacker could exploit this vulnerability to gain unauthorized access to critical kernel memory, potentially modifying system behavior and compromising device integrity. This could lead to catastrophic outcomes like executing arbitrary code at the kernel level, making the device vulnerable to further attacks. To safeguard against this issue, ensure your Android devices are updated to the latest security patches. Additionally, monitor your app's permissions and consider implementing stricter controls on memory mapping where applicable. You've got this! Stay proactive and keep your devices secure! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00560 · 45.9th percentile
Published
2022-07-13T18:23Z
EPSS history
Timeline
  • 13 JUL 18:23Z
    'remap_pfn_range' here may map out of size kernel memory (for example, may map the kernel area), and because the 'vma->vm_page_prot' can also be controlled by…
    cvelistv5