CVE-2022-20122

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The PowerVR GPU driver allows unprivileged apps to allocated pinned memory, unpin it (which makes it available to be freed), and continue using the page in GPU calls. No privileges required and this results in kernel memory corruption.Product: AndroidVersions: Android SoCAndroid ID: A-232441339

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Aug 24, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-201237.5In phNciNfc_RecvMfResp of phNxpExtns_MifareStd.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead toCVE-2022-201247.8In deletePackageX of DeletePackageHelper.java, there is a possible way for a Guest user to reset pre-loaded applications for other users dueCVE-2022-201256.8In GBoard, there is a possible way to bypass factory reset protections due to a sandbox escape. This could lead to local escalation of priviCVE-2022-201267.3In setScanMode of AdapterService.java, there is a possible way to enable Bluetooth discovery mode without user interaction due to a missing CVE-2022-201279.8In ce_t4t_data_cback of ce_t4t.cc, there is a possible out of bounds write due to a double free. This could lead to remote code execution wiCVE-2022-201295.5In registerPhoneAccount of PhoneAccountRegistrar.java, there is a possible way to prevent the user from selecting a phone account due to impCVE-2022-20137.5In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental feature flag all new CVE-2022-201309.8In transportDec_OutOfBandConfig of tpdec_lib.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to CVE-2022-201317.5In nci_proc_rf_management_ntf of nci_hrcv.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remotCVE-2022-201324.6In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds read due to improper input validatiCVE-2022-201337.8In setDiscoverableTimeout of AdapterService.java, there is a possible bypass of user interaction due to a missing permission check. This couCVE-2022-201347.8In readArguments of CallSubjectDialog.java, there is a possible way to trick the user to call the wrong phone number due to improper input v
CVE-2022-20122: Critical severity, CVSS 9.8 | Vulnix