CVE-2022-20555
published 2022-12-16CVE-2022-20555: In ufdt_get_node_by_path_len of ufdt_convert.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information…
PriorityP416medium4.4CVSS 3.1
AVLACLPRHUINSUCHINAN
EPSS
0.17%
6.7th percentile
In ufdt_get_node_by_path_len of ufdt_convert.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-246194233
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — | |
| android | — | — | |
| platform | system_libufdt | >= 13:0 < 13:2022-12-01 | 13:2022-12-01 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Google Android 13.0 ufdt_convert.c ufdt_get_node_by_path_len out-of-bounds (A-246194233 / EUVD-2022-25815)
vuldb·2026-04-21·CVSS 4.4
CVE-2022-20555 [MEDIUM] Google Android 13.0 ufdt_convert.c ufdt_get_node_by_path_len out-of-bounds (A-246194233 / EUVD-2022-25815)
A vulnerability was found in Google Android 13.0. It has been rated as problematic. Affected by this issue is the function ufdt_get_node_by_path_len of the file ufdt_convert.c. The manipulation leads to out-of-bounds read.
This vulnerability is documented as CVE-2022-20555. The attack needs to be performed locally. There is not any exploit available.
It is suggested to install a patch to address this issue.
GHSA
GHSA-rw5f-c2vx-j3q7: In ufdt_get_node_by_path_len of ufdt_convert
ghsa_unreviewed·2022-12-20
CVE-2022-20555 [MEDIUM] CWE-125 GHSA-rw5f-c2vx-j3q7: In ufdt_get_node_by_path_len of ufdt_convert
In ufdt_get_node_by_path_len of ufdt_convert.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-246194233
OSV
CVE-2022-20555: In ufdt_get_node_by_path_len of ufdt_convert
osv·2022-12-01
CVE-2022-20555 CVE-2022-20555: In ufdt_get_node_by_path_len of ufdt_convert
In ufdt_get_node_by_path_len of ufdt_convert.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-12-16
Published