{"id":"PUB-A-245727875","details":"In acquireFabricatedOverlayIterator, nextFabricatedOverlayInfos, and releaseFabricatedOverlayIterator of Idmap2Service.cpp, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-245727875","CVE-2022-20514"],"modified":"2026-09-21T16:00:45.521740994Z","published":"2022-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-12-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2022-12-01"}]}],"versions":["13"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["202144605245939720251509576265784988526","330769806256285511734640313767817607067","259150600434666024271713942170730307963","161197007327016784247419469716286819883","213649559135418921952722414716867649745","110997725776607251104688224660060920790","269110589052959533129509137817997698823","134033327854937878005143378424563197206","98557741935767421530475903653237422025","129721126637824583780146227853750890791","315455738768515044972829036375890502656","76097017087085971618204101969736470696","263591436060064920975406788388328235747","293266033177949486040250603326668613039","195458246910038704047738189155196304942"]},"id":"PUB-A-245727875-0c9cf060","match_only_versions":["13"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7b4d4ca5e91442ddbfcccb55715d75a67caf3eff","target":{"file":"cmds/idmap2/idmap2d/Idmap2Service.h"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7b4d4ca5e91442ddbfcccb55715d75a67caf3eff","target":{"file":"cmds/idmap2/idmap2d/Idmap2Service.cpp","function":"Idmap2Service::releaseFabricatedOverlayIterator"},"deprecated":false,"digest":{"function_hash":"128238835769563262526376303371421509067","length":188},"id":"PUB-A-245727875-18d69b9e","match_only_versions":["13"]},{"source":"https://android.googlesource.com/platform/frameworks/base/+/7b4d4ca5e91442ddbfcccb55715d75a67caf3eff","target":{"file":"services/core/java/com/android/server/om/IdmapDaemon.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["173878378130585961525477744600721970319","132074071168239705163824294383011427837","138532562503580825919421853115472906121","200591613810910865680879981254494159797","103625173946191337680417769958015073879","84489702151922584588412848252929004219","331853712388543601573301003843828083558","266566864798860293020067439539612057357","173348021665044163013060332967203523662","233520430412045177845837276516993102823","172972815455062368100957108325688654431","181843542997600225454872314804627202521","80643085619206638811849638644354893598","245888006204501543980229829218930029851","177880368932349782704836823432995736125"]},"id":"PUB-A-245727875-32aa3481","signature_type":"Line","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/7b4d4ca5e91442ddbfcccb55715d75a67caf3eff","target":{"file":"cmds/idmap2/idmap2d/Idmap2Service.cpp","function":"Idmap2Service::acquireFabricatedOverlayIterator"},"deprecated":false,"digest":{"function_hash":"277250484928001438501085393364757954445","length":274},"id":"PUB-A-245727875-73029bb1","match_only_versions":["13"],"signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7b4d4ca5e91442ddbfcccb55715d75a67caf3eff","target":{"file":"cmds/idmap2/idmap2d/Idmap2Service.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["335508212848529320130941775471281471375","247010988445414438717903323833902769671","260760833771983472096629041183133918732","338455860354854258872681810071073314449","188449024047390492033308208183224108094","89524368815610759066779601728809994683","147864111382000992897210086620323889117","327954751995803708693263382213534917852","200884567399239735045801691860803941260","6364661984164964455001201932440196778","239481236222271477415707817173310200851","154873128487390619554655325990734213463","240224622319562219863306758965397646916","38779568061203223543066628845586147923","290878488430807259587714893807331004872","150286024051241244633676608811541583944","96650879885008780849898948048915521728","332927081150394699326047317358717119083","243851370226385090765940737223011728989","245327289110595502084535914678414045764","336810405225418341033146821859695862309","93715516425450273436580435156234171918","126297971039372035158051589720007182590","328806490951645775192167325286591572112","19229873875247842330421251070778814492","105812658327017990407615533547707082148","310851104083474568931001323637425571376","233084245510637938935777208594406398867","102766038453801880087343436490123823625","71632389433556724631427781716457297300","194128946610251710817123531446458163491","189088734584751374825048766943343137829","128561949479291513620375721409925184235","218778291065677745332137247709455180508","53063973147780853482482498525914283210","91406492069376375065078964027522298810","89325681585622757088111002792049813293","67942476515526239342243379962795884170","21635385864238047163522585406220539239","327182057370524198866758476226645656853","142822100010796637443203338934302204420","126342001370789589283304247172094116688"]},"id":"PUB-A-245727875-ab08fb95","match_only_versions":["13"],"signature_type":"Line"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/7b4d4ca5e91442ddbfcccb55715d75a67caf3eff","target":{"file":"services/core/java/com/android/server/om/IdmapDaemon.java","function":"getFabricatedOverlayInfos"},"deprecated":false,"digest":{"function_hash":"338104360767757828585167012306991980203","length":690},"id":"PUB-A-245727875-fea677b1","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7b4d4ca5e91442ddbfcccb55715d75a67caf3eff"],"severity":"Moderate","spl":"2022-12-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-245727875.json"}}],"schema_version":"1.9.0"}