CVE-2022-20454 — Integer Overflow or Wraparound in Google Android

CWE-190 — Integer Overflow or Wraparound5 documents5 sources
Severity
6.7MEDIUMNVD
EPSS
0.0%
top 89.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Platform External DTCGoogle Android
Timeline
PublishedNov 8
Latest updateApr 15

Description

In fdt_next_tag of fdt.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242096164

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5google/androidAndroid-10 Android-11 Android-12 Android-12L Android-13
▶NVDgoogle/android5 versions+4
▶Androidplatform/external_dtc10:0 — 10:2022-11-01+4

🔴Vulnerability Details

3
VulDB
Google Android 10.0/11.0/12.0/13.0 fdt.c fdt_next_tag out-of-bounds write (A-242096164 / EUVD-2022-25714)↗2026-04-15
▶
GHSA
GHSA-72gj-xg53-728v: In fdt_next_tag of fdt↗2022-11-09
▶
OSV
CVE-2022-20454: In fdt_next_tag of fdt↗2022-11-01
▶

📋Vendor Advisories

1
Android
CVE-2022-20454: Android Security Bulletin 2022-11-01 CVE: CVE-2022-20454 Severity: HIGH Type: EoP Affected AOSP versions: 10, 11, 12, 12L, 13 References: A-242096164↗2022-11-01
▶