What is CVE-2022-20008?

CVE-2022-20008 is a medium-severity vulnerability in Google Android, classified under Use of Uninitialized Resource. CVSS score: 4.6/10. Published 2022-05-10.

How severe is CVE-2022-20008?

Medium severity. CVSS v3 base score is 4.6 out of 10.

Is CVE-2022-20008 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Google Android

CVE-2022-20008

In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized data. This could lead to local information disclosure if reading from an SD card that triggers errors, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-216481035References: Upstream kernel

EPSS: 0.004 (28.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.6 (Medium). Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Google Android
N/a Android — versions Android kernel

Weakness classification (CWE)

CWE-908 — Use of Uninitialized Resource

Public proof-of-concept exploits

ARPSyndicate/cvemon

References

security@android.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2022-20008?: CVE-2022-20008 is a medium-severity vulnerability in Google Android, classified under Use of Uninitialized Resource. CVSS score: 4.6/10. Published 2022-05-10.
How severe is CVE-2022-20008?: Medium severity. CVSS v3 base score is 4.6 out of 10.
Is CVE-2022-20008 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.