CVE-2022-42504

In CallDialReqData::encodeCallNumber of callreqdata.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-241232209References: N/A

CVSS v3 6.7 MEDIUM

6.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://source.android.com/security/bulletin/pixel/2022-12-01	Vendor Advisory
https://source.android.com/security/bulletin/pixel/2022-12-01	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:google:android:-:*:*:*:*:*:*:*

History

21 Nov 2024, 07:25

Type	Values Removed	Values Added
References	~~() https://source.android.com/security/bulletin/pixel/2022-12-01 - Vendor Advisory~~	() https://source.android.com/security/bulletin/pixel/2022-12-01 - Vendor Advisory
Summary		(es) En CallDialReqData::encodeCallNumber de callreqdata.cpp, existe una posible escritura fuera de los límites debido a una verificación de límites incorrecta. Esto podría conducir a una escalada local de privilegios con privilegios de ejecución del sistema necesarios. No se necesita la interacción del usuario para la explotación.Producto: AndroidVersiones: kernel de AndroidID de Android: A-241232209Referencias: N/A

Information

Published : 2022-12-16 16:15

Updated : 2025-04-18 14:15

NVD link : CVE-2022-42504

Mitre link : CVE-2022-42504

CVE.ORG link : CVE-2022-42504

JSON object : View

Products Affected

google

android

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2022-42504", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}]}, "published": "2022-12-16T16:15:22.703", "references": [{"url": "https://source.android.com/security/bulletin/pixel/2022-12-01", "tags": ["Vendor Advisory"], "source": "security@android.com"}, {"url": "https://source.android.com/security/bulletin/pixel/2022-12-01", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "In CallDialReqData::encodeCallNumber of callreqdata.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-241232209References: N/A"}, {"lang": "es", "value": "En CallDialReqData::encodeCallNumber de callreqdata.cpp, existe una posible escritura fuera de los l\u00edmites debido a una verificaci\u00f3n de l\u00edmites incorrecta. Esto podr\u00eda conducir a una escalada local de privilegios con privilegios de ejecuci\u00f3n del sistema necesarios. No se necesita la interacci\u00f3n del usuario para la explotaci\u00f3n.Producto: AndroidVersiones: kernel de AndroidID de Android: A-241232209Referencias: N/A"}], "lastModified": "2025-04-18T14:15:19.590", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}], "operator": "OR"}]}], "sourceIdentifier": "security@android.com"}