{"id":"PUB-A-195565510","details":"In dm_bow_dtr and related functions of dm-bow.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-195565510","CVE-2022-20371"],"modified":"2026-09-22T15:22:15.314525410Z","published":"2022-08-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-08-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/98c15b2bad1a277da43c65c642f8c3c3ee07bacc"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2022-08-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/98c15b2bad1a277da43c65c642f8c3c3ee07bacc"],"severity":"Moderate","spl":"2022-08-05","types":["EoP"],"vanir_signatures":[{"target":{"function":"dm_bow_tablestatus","file":"drivers/md/dm-bow.c"},"deprecated":false,"digest":{"function_hash":"300623058887106438639998738184871824885","length":1766},"id":"PUB-A-195565510-7b8acf61","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/98c15b2bad1a277da43c65c642f8c3c3ee07bacc"},{"source":"https://android.googlesource.com/kernel/common/+/98c15b2bad1a277da43c65c642f8c3c3ee07bacc","target":{"function":"dm_bow_dtr","file":"drivers/md/dm-bow.c"},"deprecated":false,"digest":{"length":585,"function_hash":"119541222737437405754465789162473268266"},"id":"PUB-A-195565510-9a121adf","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["210528478982510810512017091586596720208","56631021494367431502376452530418987301","296938718703752194777952282247727750122","283133436498866206716099143014693437961","216318043032516306600134203873986421352","16009197771944378345913954967615683802","63151124323441283135289797533053986964","106275888963423701560047225749777722533","196858020902199020907883732047417894700","139694378267861962548719201743562885363","194410803758847343932754155637896052861","332661763034759071879096855513628834418","109198577053479151906246279893300339782","51304242106362557493327900973676952696","90248369729768167000097374149840699291","273144972073058850423935727568434171136","2496148158937308589258696067892728086","4010694919209660172690847769604700910","65666508967777905695114139049228042361","191281537505120453540333486009769282011","251814008950990938731138577727385096684","113453508866513751378469520349129405259","84820555433131491113929279993959527402","284160969531944944562907361310981145857","103179916215259758251121074132317908268","803470752594545913040705527228630453","206375343508973339861173139393830973895","169303888298583346145886790207390516954","235895896430382411011785008258779521370","87066304395322783099696455335819731491","56145270587768740578302983069037509341"],"threshold":0.9},"id":"PUB-A-195565510-e41c296a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/98c15b2bad1a277da43c65c642f8c3c3ee07bacc","target":{"file":"drivers/md/dm-bow.c"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-195565510.json"}}],"schema_version":"1.9.0"}