CVE-2022-20235
Last modified
CVE-2022-20235 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. The PowerVR GPU kernel driver maintains an "Information Page" used by its cache subsystem. This page can only be written by the GPU driver itself, but prior to DDK 1.18 however, a user-space program could write arbitrary data to the page, leading to memory corruption issues.Product: AndroidVersions: Android SoCAndroid ID: A-259967780. EPSS estimates a 0.11% chance of exploitation in the next 30 days.
Description
The PowerVR GPU kernel driver maintains an "Information Page" used by its cache subsystem. This page can only be written by the GPU driver itself, but prior to DDK 1.18 however, a user-space program could write arbitrary data to the page, leading to memory corruption issues.Product: AndroidVersions: Android SoCAndroid ID: A-259967780
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Android | All versions |
References
- https://source.android.com/security/bulletin/2023-01-01Vendor Advisory
- https://source.android.com/security/bulletin/2023-01-01Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-20235?
How severe is CVE-2022-20235?
How do I fix CVE-2022-20235?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-20229In bta_hf_client_handle_cind_list_item of bta_hf_client_at.c…9.8
- CVE-2022-2023Incorrect Use of Privileged APIs in GitHub repository polone…9.8
- CVE-2022-20230In choosePrivateKeyAlias of KeyChain.java, there is a possib…5.5
- CVE-2022-20231In smc_intc_request_fiq of arm_gic.c, there is a possible ou…6.7
- CVE-2022-20233In param_find_digests_internal and related functions of the …6.7
- CVE-2022-20234In Car Settings app, the NotificationAccessConfirmationActiv…7.5
- CVE-2022-20236A drm driver have oob problem, could cause the system crash …7.5
- CVE-2022-20237In BuildDevIDResponse of miscdatabuilder.cpp, there is a pos…9.8
- CVE-2022-20238'remap_pfn_range' here may map out of size kernel memory (fo…9.8
- CVE-2022-20239remap_pfn_range' here may map out of size kernel memory (for…9.8
- CVE-2022-2024OS Command Injection in GitHub repository gogs/gogs prior to…9.8
- CVE-2022-20240In sOpAllowSystemRestrictionBypass of AppOpsManager.java, th…2.3
Are you affected by CVE-2022-20235?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST