{"id":"ASB-A-209075540","aliases":["2338216","2747422","A-209075540","CVE-2022-22058"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2022-07-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-07-01"},{"type":"FIX","url":"https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=6186c322d99c4c35f18a777eef158486a9d24ec9"},{"type":"FIX","url":"https://git.codelinaro.org/clo/la/kernel/msm-4.4/-/commit/52ad8f0aff9106ce15cd6c1ff6a029255cb6843a"}],"affected":[{"package":{"name":":linux_kernel:Qualcomm","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"SoCVersion:0"},{"fixed":"SoCVersion:2022-07-05"}]}],"versions":["SoCVersion"],"ecosystem_specific":{"spl":"2022-07-05","types":["Unknown"],"vanir_signatures":[{"digest":{"function_hash":"313670877830261718005236610484083499632","length":2534},"id":"ASB-A-209075540-189f3717","signature_type":"Function","signature_version":"v1","source":"https://git.codelinaro.org/clo/la/kernel/msm-4.9/commit/6186c322d99c4c35f18a777eef158486a9d24ec9","target":{"file":"drivers/staging/android/ion/ion.c","function":"ion_ioctl"},"deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["203107143103694726942804339787343205078","316067700936967464699804245416798050325","273208244168219521104550026215430553256","64762472788319238184153080510659434168","208709162276539729257206725445508448111","226284045303793911651320599863171399758","190361020356961702197955744963686879096","269430221649121649858519135774336648432","42834617005988096547508329792267185765"]},"id":"ASB-A-209075540-2867a203","signature_type":"Line","signature_version":"v1","source":"https://git.codelinaro.org/clo/la/kernel/msm-4.9/commit/6186c322d99c4c35f18a777eef158486a9d24ec9","target":{"file":"drivers/staging/android/ion/ion.c"},"deprecated":false},{"target":{"file":"drivers/staging/android/ion/ion.c","function":"ion_phys"},"deprecated":false,"digest":{"length":596,"function_hash":"62550660304587722383353842066635888328"},"id":"ASB-A-209075540-28c61c1c","signature_type":"Function","signature_version":"v1","source":"https://git.codelinaro.org/clo/la/kernel/msm-4.4/commit/52ad8f0aff9106ce15cd6c1ff6a029255cb6843a"},{"signature_version":"v1","source":"https://git.codelinaro.org/clo/la/kernel/msm-4.4/commit/52ad8f0aff9106ce15cd6c1ff6a029255cb6843a","target":{"file":"drivers/staging/android/ion/ion.c","function":"ion_import_dma_buf"},"deprecated":false,"digest":{"function_hash":"50684157946491631830967368608765938221","length":795},"id":"ASB-A-209075540-32d71e43","signature_type":"Function"},{"digest":{"line_hashes":["272130985688768516815124335372553667450","191200563842085584221731561810588508504","141260881342331362616019498586674760029","168566488386790360483326063372677046737","321957209160194425878274724664420407140","50999721131295651739340254293239972868","34450346491285218408856522544422669587","238998662115402332943223377706434791622","323661176455930356326447490740536564573","283073213744195368198032762597382096272","65264028583463200963092873319930589217","132986194037501743729107736018326011879","173837812156604585911376928649796735562","226876186284708354735963230158168806346","224488762760217231136130486975953865716","66779629812231859345233934860410220300","139959362491795049705136045117193762513","161788460852369129312235424821745585785","135617328054686189623692053771021851855","165406810494529109394699560786033572828","103722693068349204250031269687020415682","290775488690113784047098495972273217445","308711807176837068132467154563702906915","333659844461341888834686795837595362880","297772230231658388791719364088436662334","238386870898102564642258879754480907865","131670801702787557136384908905239727671","57251282595049731631779119130136413103","124168254356719139714641435149376232252","24807645216843145167824859229487468002","64223289521773591774952793198632255694","28938744837876971569290010434440236504","267703345014414002871512202397687574026","175411667205069290990186421695056467845","337261739226289056350234772746787967102","102504686660337525320357219004370939334","88767958682223740766938712766762164998","244831934732070072974141856984983497564","227569855289746909977627338718205793785","339565440580496541437195609278621061988","212106082415919958250275479230234390563","168902558098264140999185043304817596884","11889796031408664312565303858546884757","78285011673449783295708311650405824398","33467459361479228455298285538652467546","40621701072111873945784451067816378121","294673851737793747074399009578293413107","268465315620955005020160081208525635561","263059830589891484835454195502539270644","151402867257552201808387114154485540269","74257397335572209439283232731360616734","148100472813949198361749932138150960349","237946030031268665853810316907478364339","163025549612852027572597938857106386772","211085835871166092997306890243120153366","129037776003602966445219931702787067972","139118299286772727213774588165887638030","307029270976867730163509111853380205058","286675613117463985376745393372183056652","271935215113043059492898317236327366873","130825725715135125859745550637860187065","201382056448753360943440420279052867091","305473090537274873892013903086829266014","297759748229952758338649466184443807667","210699301543706307818607186931414137846","86168715525654700550571168504426010315","2685331695162149666435748069935253689","254437501297194271034077600246951358372","80664463670969794539812558548064267374","129687760573128069170425256300727523136","127046516945641258275995481828243370371","84808512257320351730972764740593149590","4471756038962223277990484009174938362","72780421198229903236869343926950166713","311792182902829219323997680647413156250"],"threshold":0.9},"id":"ASB-A-209075540-345ef6d9","signature_type":"Line","signature_version":"v1","source":"https://git.codelinaro.org/clo/la/kernel/msm-4.4/commit/52ad8f0aff9106ce15cd6c1ff6a029255cb6843a","target":{"file":"drivers/staging/android/ion/ion.c"},"deprecated":false},{"target":{"function":"msm_ion_do_cache_op","file":"drivers/staging/android/ion/msm/msm_ion.c"},"deprecated":false,"digest":{"function_hash":"228108783425620797934400530439470600225","length":178},"id":"ASB-A-209075540-3a3471cf","signature_type":"Function","signature_version":"v1","source":"https://git.codelinaro.org/clo/la/kernel/msm-4.4/commit/52ad8f0aff9106ce15cd6c1ff6a029255cb6843a"},{"digest":{"function_hash":"202055314683871569259794851325410587436","length":937},"id":"ASB-A-209075540-3ad203fc","signature_type":"Function","signature_version":"v1","source":"https://git.codelinaro.org/clo/la/kernel/msm-4.4/commit/52ad8f0aff9106ce15cd6c1ff6a029255cb6843a","target":{"file":"drivers/staging/android/ion/msm/msm_ion.c","function":"ion_pages_cache_ops"},"deprecated":false},{"deprecated":false,"digest":{"length":637,"function_hash":"146580793778283105022862187350393656452"},"id":"ASB-A-209075540-47782eb7","signature_type":"Function","signature_version":"v1","source":"https://git.codelinaro.org/clo/la/kernel/msm-4.4/commit/52ad8f0aff9106ce15cd6c1ff6a029255cb6843a","target":{"function":"ion_do_cache_op","file":"drivers/staging/android/ion/msm/msm_ion.c"}},{"signature_version":"v1","source":"https://git.codelinaro.org/clo/la/kernel/msm-4.4/commit/52ad8f0aff9106ce15cd6c1ff6a029255cb6843a","target":{"file":"drivers/staging/android/ion/msm/msm_ion.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["142215683726653231297388763358610414551","123008976233481555711575071588036548556","54900875358876234548648759665715364496","233814138442139523332623403839305997953","245375241447749454225177152537005225817","137870523639859577867562319409699089382","16978895518400010651539044931612229234","149712038657912749572448245961525892845","228752573593701877985170052209455492055","54243106536193193187129152061684593006","283840243160891866929004188783932636846","299024641679446607251181755323396742412","177870627591373763681673480061261213655","140698980835849359408439111728652723065","202854236780896829322208534583496052989","11866537514021658779116285521374995644","2382641063387913866334637602943239194","275083782227248504841675193458079789062","182493081570171355949453653921968239833","107542832567657404991194147404018561914","234921894551542617276765845018566146777","276417551876152894962506290940668774207","91613272710439106026074375583949331800","331636912644719320966889941237288923068","220864361813283336134062997492646226351","58090598145221557695232781613979012752","94101205177784785725020527470390009226","201437229387860180463132575066965758611","46340135756002415106662939100433236842","3814242831874619271791059904821474951","243575707171782100370576400421754665953","75368478910020211326099310081449096426","85894714749034568927822622395139347587","244553138584376063918173380307627026668","15415040780644073171199684641120046979","263058184202490511410310836539468801726","328496691373920503947793112926064285969","247068304175460492727888472798162023494","223765548145953953604644796187983947787","214144624277041510033419308962384933544","146678019303298451312680026954949612280","62654667454011105012026646584073294210","95648977453968031803114998806561978169","257389147364777232346097195431105130255","114753151659096708534196880268893588837","313809873986955321132070031190474411956","325217552885310946325819609133057611217","224484331305403008144045928370044828733"]},"id":"ASB-A-209075540-7dd83076","signature_type":"Line"},{"id":"ASB-A-209075540-a7610fbf","signature_type":"Function","signature_version":"v1","source":"https://git.codelinaro.org/clo/la/kernel/msm-4.4/commit/52ad8f0aff9106ce15cd6c1ff6a029255cb6843a","target":{"function":"ion_free_nolock","file":"drivers/staging/android/ion/ion.c"},"deprecated":false,"digest":{"function_hash":"203447122605118403271467969579223259375","length":261}},{"signature_type":"Function","signature_version":"v1","source":"https://git.codelinaro.org/clo/la/kernel/msm-4.4/commit/52ad8f0aff9106ce15cd6c1ff6a029255cb6843a","target":{"function":"ion_handle_get_by_id_nolock","file":"drivers/staging/android/ion/ion.c"},"deprecated":false,"digest":{"length":185,"function_hash":"157733383051534200773111866794841376747"},"id":"ASB-A-209075540-b26ca223"},{"target":{"function":"msm_ion_do_cache_offset_op","file":"drivers/staging/android/ion/msm/msm_ion.c"},"deprecated":false,"digest":{"function_hash":"210324884579166726136895594111075915462","length":205},"id":"ASB-A-209075540-b4630d13","signature_type":"Function","signature_version":"v1","source":"https://git.codelinaro.org/clo/la/kernel/msm-4.4/commit/52ad8f0aff9106ce15cd6c1ff6a029255cb6843a"},{"signature_type":"Line","signature_version":"v1","source":"https://git.codelinaro.org/clo/la/kernel/msm-4.4/commit/52ad8f0aff9106ce15cd6c1ff6a029255cb6843a","target":{"file":"drivers/staging/android/ion/ion_priv.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["191057568063824288446480204839152531169","66790911036292014051250167180761569661","26676436863214937075169357849529597651","187620068579749199556754986075799873612","270553331541479258017365112171388856542"]},"id":"ASB-A-209075540-c219508e"},{"signature_type":"Function","signature_version":"v1","source":"https://git.codelinaro.org/clo/la/kernel/msm-4.4/commit/52ad8f0aff9106ce15cd6c1ff6a029255cb6843a","target":{"file":"drivers/staging/android/ion/msm/msm_ion.c","function":"msm_ion_custom_ioctl"},"deprecated":false,"digest":{"function_hash":"300869683087902728684371925596211383904","length":2411},"id":"ASB-A-209075540-d6b94d3d"},{"digest":{"function_hash":"257640874776738313320362658483379389384","length":165},"id":"ASB-A-209075540-db4f1a32","signature_type":"Function","signature_version":"v1","source":"https://git.codelinaro.org/clo/la/kernel/msm-4.4/commit/52ad8f0aff9106ce15cd6c1ff6a029255cb6843a","target":{"file":"drivers/staging/android/ion/ion.c","function":"ion_handle_validate"},"deprecated":false},{"signature_version":"v1","source":"https://git.codelinaro.org/clo/la/kernel/msm-4.4/commit/52ad8f0aff9106ce15cd6c1ff6a029255cb6843a","target":{"file":"drivers/staging/android/ion/ion.c","function":"ion_handle_get_by_id"},"deprecated":false,"digest":{"length":176,"function_hash":"270920885514079591636545813218744833159"},"id":"ASB-A-209075540-dbe5354a","signature_type":"Function"}],"fixes":["https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=6186c322d99c4c35f18a777eef158486a9d24ec9","https://git.codelinaro.org/clo/la/kernel/msm-4.4/-/commit/52ad8f0aff9106ce15cd6c1ff6a029255cb6843a"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-209075540.json"}}],"schema_version":"1.9.0"}