Security readout for executives and security teams
Plain-English summary
This is an Android kernel memory-safety flaw. A locally privileged attacker could potentially turn it into higher privileges on the device. The public bundle does not show active exploitation, and the CVSS vector requires high existing privileges, reducing broad remote risk.
Executive priority
Treat as a moderate mobile endpoint hygiene issue. It is not a remote unauthenticated emergency based on the provided evidence, but affected Android fleets should be patched through normal security update channels because successful exploitation could grant powerful device privileges.
Technical view
CVE-2022-20158 is a CWE-416 use-after-free in Android kernel backing-dev.c functions bdi_put and bdi_unregister. The stated impact is possible memory corruption leading to local privilege escalation to System. CVSS 3.1 is 6.7 with local access, low complexity, high privileges required, and no user interaction.
Likely exposure
Exposure is limited to Android devices using affected Android kernel code. Risk is most relevant where attackers already have high local privileges, device code execution, or footholds on managed Android devices. The bundle does not identify specific device models, kernel versions, or OEM patch levels.
Exploitation context
The source bundle provides no evidence of active exploitation and KEV is false. Exploitation is described as local, no user interaction, and requiring System execution privileges. No public exploit mechanics or weaponization details are included in the provided evidence.
Researcher notes
Evidence is sparse. The CVE names backing-dev.c, bdi_put, and bdi_unregister, but the bundle does not include a fixing commit, affected kernel ranges, or OEM-specific build mapping. Validate exposure through vendor bulletins and device patch metadata rather than assuming all Android devices are affected.
Mitigation direction
- Follow Android and OEM guidance for CVE-2022-20158 remediation.
- Apply device updates that include the relevant August 2022 Android or Pixel security fixes.
- Prioritize managed Android devices with elevated local app or debugging exposure.
- Retire or isolate devices that cannot receive vendor kernel security updates.
Validation and detection
- Inventory Android devices and record OS, kernel, OEM, and security patch level.
- Compare device patch status against Android, Pixel, and OEM security bulletin guidance.
- Confirm MDM compliance policies require current Android security patch levels.
- Review vulnerability scanner findings for CVE-2022-20158 or Android kernel exposure.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-20158 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H0.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.7MediumVector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://source.android.com/security/bulletin/pixel/2022-08-01CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.