CVE-2022-20590 : In valid_va_sec_mfc_check of drm_access_control.c, there is a possible information disclosure due to improper input vali

In valid_va_sec_mfc_check of drm_access_control.c, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238932493References: N/A

Published 2022-12-16 16:15:21

Updated 2022-12-21 04:36:24

Source Android (associated with Google Inc. or Open Handset Alliance)

View at NVD, CVE.org

Vulnerability category: Input validationInformation leak

Exploit prediction scoring system (EPSS) score for CVE-2022-20590

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-20590

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2022-20590

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

Products affected by CVE-2022-20590

Google » Android » Version: N/A
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2022-20590

Exploit prediction scoring system (EPSS) score for CVE-2022-20590

CVSS scores for CVE-2022-20590

CWE ids for CVE-2022-20590

References for CVE-2022-20590

Products affected by CVE-2022-20590