CVE-2022-20117

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In (TBD) of (TBD), there is a possible way to decrypt local data encrypted by the GSC due to improperly used crypto. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-217475903References: N/A

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-327

Affected software

No affected versions have been published.

Timeline

Published
May 10, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-201187.0In ion_ioctl and related functions of ion.c, there is a possible use after free due to a race condition. This could lead to local escalationCVE-2022-201195.5In private_handle_t of mali_gralloc_buffer.h, there is a possible information disclosure due to uninitialized data. This could lead to localCVE-2022-201209.8Product: AndroidVersions: Android kernelAndroid ID: A-203213034References: N/ACVE-2022-201215.5In getNodeValue of USCCDMPlugin.java, there is a possible disclosure of ICCID due to a missing permission check. This could lead to local inCVE-2022-201229.8The PowerVR GPU driver allows unprivileged apps to allocated pinned memory, unpin it (which makes it available to be freed), and continue usCVE-2022-201237.5In phNciNfc_RecvMfResp of phNxpExtns_MifareStd.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead toCVE-2022-201247.8In deletePackageX of DeletePackageHelper.java, there is a possible way for a Guest user to reset pre-loaded applications for other users dueCVE-2022-201256.8In GBoard, there is a possible way to bypass factory reset protections due to a sandbox escape. This could lead to local escalation of priviCVE-2022-201267.3In setScanMode of AdapterService.java, there is a possible way to enable Bluetooth discovery mode without user interaction due to a missing CVE-2022-201279.8In ce_t4t_data_cback of ce_t4t.cc, there is a possible out of bounds write due to a double free. This could lead to remote code execution wiCVE-2022-201295.5In registerPhoneAccount of PhoneAccountRegistrar.java, there is a possible way to prevent the user from selecting a phone account due to impCVE-2022-20137.5In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental feature flag all new
CVE-2022-20117: Medium severity, CVSS 5.5 | Vulnix