{"id":"ASB-A-221862119","details":"In ce_t4t_data_cback of ce_t4t.cc, there is a possible out of bounds write due to a double free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-221862119","CVE-2022-20127"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2022-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/system/nfc/+/2fcf7d677bcebae5a00db43938460bcce267149e"}],"affected":[{"package":{"name":"platform/system/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L-next:0"},{"fixed":"12L-next:2022-06-01"}]}],"versions":["12L-next"],"ecosystem_specific":{"spl":"2022-06-01","types":["RCE"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"104878374239606386092160028817565736155","length":5507},"id":"ASB-A-221862119-61ece92b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/2fcf7d677bcebae5a00db43938460bcce267149e","target":{"file":"src/nfc/tags/ce_t4t.cc","function":"ce_t4t_data_cback"}},{"digest":{"threshold":0.9,"line_hashes":["288755587739503399973484087706792439868","235957353039854732531163373805571340181","178676705441890409717555889950227732401","126937206315459210288597319086747904932"]},"id":"ASB-A-221862119-736012b3","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/2fcf7d677bcebae5a00db43938460bcce267149e","target":{"file":"src/nfc/tags/ce_t4t.cc"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/system/nfc/+/2fcf7d677bcebae5a00db43938460bcce267149e"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-221862119.json"}},{"package":{"name":"platform/system/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2022-06-01"}]}],"versions":["10"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-221862119-343dd870","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/2fcf7d677bcebae5a00db43938460bcce267149e","target":{"file":"src/nfc/tags/ce_t4t.cc"},"deprecated":false,"digest":{"line_hashes":["288755587739503399973484087706792439868","235957353039854732531163373805571340181","178676705441890409717555889950227732401","126937206315459210288597319086747904932"],"threshold":0.9}},{"id":"ASB-A-221862119-aa044d21","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/2fcf7d677bcebae5a00db43938460bcce267149e","target":{"file":"src/nfc/tags/ce_t4t.cc","function":"ce_t4t_data_cback"},"deprecated":false,"digest":{"function_hash":"104878374239606386092160028817565736155","length":5507}}],"fixes":["https://android.googlesource.com/platform/system/nfc/+/2fcf7d677bcebae5a00db43938460bcce267149e"],"severity":"Critical","spl":"2022-06-01","types":["RCE"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-221862119.json"}},{"package":{"name":"platform/system/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2022-06-01"}]}],"versions":["11"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/nfc/+/2fcf7d677bcebae5a00db43938460bcce267149e"],"severity":"Critical","spl":"2022-06-01","types":["RCE"],"vanir_signatures":[{"target":{"file":"src/nfc/tags/ce_t4t.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["288755587739503399973484087706792439868","235957353039854732531163373805571340181","178676705441890409717555889950227732401","126937206315459210288597319086747904932"]},"id":"ASB-A-221862119-5b367f01","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/2fcf7d677bcebae5a00db43938460bcce267149e"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/2fcf7d677bcebae5a00db43938460bcce267149e","target":{"file":"src/nfc/tags/ce_t4t.cc","function":"ce_t4t_data_cback"},"deprecated":false,"digest":{"length":5507,"function_hash":"104878374239606386092160028817565736155"},"id":"ASB-A-221862119-91204f54","signature_type":"Function"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-221862119.json"}},{"package":{"name":"platform/system/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2022-06-01"}]}],"versions":["12"],"ecosystem_specific":{"spl":"2022-06-01","types":["RCE"],"vanir_signatures":[{"id":"ASB-A-221862119-5008a5a6","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/2fcf7d677bcebae5a00db43938460bcce267149e","target":{"file":"src/nfc/tags/ce_t4t.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["288755587739503399973484087706792439868","235957353039854732531163373805571340181","178676705441890409717555889950227732401","126937206315459210288597319086747904932"]}},{"digest":{"length":5507,"function_hash":"104878374239606386092160028817565736155"},"id":"ASB-A-221862119-bb145cbc","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/2fcf7d677bcebae5a00db43938460bcce267149e","target":{"file":"src/nfc/tags/ce_t4t.cc","function":"ce_t4t_data_cback"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/system/nfc/+/2fcf7d677bcebae5a00db43938460bcce267149e"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-221862119.json"}},{"package":{"name":"platform/system/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-06-01"}]}],"versions":["12L"],"ecosystem_specific":{"types":["RCE"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/system/nfc/+/2fcf7d677bcebae5a00db43938460bcce267149e","target":{"file":"src/nfc/tags/ce_t4t.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["288755587739503399973484087706792439868","235957353039854732531163373805571340181","178676705441890409717555889950227732401","126937206315459210288597319086747904932"]},"id":"ASB-A-221862119-4be8c439","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"104878374239606386092160028817565736155","length":5507},"id":"ASB-A-221862119-ace169cf","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/nfc/+/2fcf7d677bcebae5a00db43938460bcce267149e","target":{"file":"src/nfc/tags/ce_t4t.cc","function":"ce_t4t_data_cback"}}],"fixes":["https://android.googlesource.com/platform/system/nfc/+/2fcf7d677bcebae5a00db43938460bcce267149e"],"severity":"Critical","spl":"2022-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-221862119.json"}}],"schema_version":"1.9.0"}