CVE-2022-20499 — Google Android vulnerability

6 documents5 sources

Severity

5.5MEDIUMNVD

EPSS

0.0%

top 90.66%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Platform Packages Modules Wifi Google Android

Timeline

PublishedMar 24

Description

In validateForCommonR1andR2 of PasspointConfiguration.java, uncaught errors in parsing stored configs could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-246539931

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5google/androidAndroid-12 Android-12L Android-13

▶NVDgoogle/android12.0, 12.1, 13.0+2

▶Androidplatform/packages_modules_wifi12:0 — 12:2023-03-01+2

Patches

Patch: source.android.com ↗Patch: source.android.com ↗

🔴Vulnerability Details

OSV

CVE-2022-20499: In validateForCommonR1andR2 of PasspointConfiguration↗2023-03-24

▶

CVEList

CVE-2022-20499: In validateForCommonR1andR2 of PasspointConfiguration↗2023-03-24

▶

GHSA

GHSA-5xhh-fjfj-vrw4: In validateForCommonR1andR2 of PasspointConfiguration↗2023-03-24

▶

OSV

CVE-2022-20499: In validateForCommonR1andR2 of PasspointConfiguration↗2023-03-01

▶

📋Vendor Advisories

Android

CVE-2022-20499: Android Security Bulletin 2023-03-01 CVE: CVE-2022-20499 Severity: HIGH Type: DoS Affected AOSP versions: 12, 12L, 13 References: A-246539931↗2023-03-01

▶