Android Kernel Use-After-Free Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-05-23

[ Description ]Official description

In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-204573007References: Upstream kernel

CISA: Android kernel contains a use-after-free vulnerability that allows for privilege escalation.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 13 Jun 2022): Apply updates per vendor instructions.

• Patch on source.android.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• source.android.com/security/bulletin/2021-11-01PatchVendor Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogThird Party AdvisoryUS Government Resource