{"id":"PUB-A-245770596","details":"In removeEventHubDevice of InputDevice.cpp, there is a possible OOB read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-245770596","CVE-2022-20554"],"modified":"2026-09-24T20:28:40.724672881Z","published":"2022-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/native/+/6c57b2f55412a04a3a9d738af0185d0ca26f932f"}],"affected":[{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2022-12-01"}]}],"versions":["13"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/native/+/6c57b2f55412a04a3a9d738af0185d0ca26f932f"],"severity":"Moderate","spl":"2022-12-01","types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"104033181600306687417379434953389051811","length":90},"id":"PUB-A-245770596-2c0a951c","match_only_versions":["13"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/6c57b2f55412a04a3a9d738af0185d0ca26f932f","target":{"function":"InputDevice::removeEventHubDevice","file":"services/inputflinger/reader/InputDevice.cpp"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/native/+/6c57b2f55412a04a3a9d738af0185d0ca26f932f","target":{"file":"services/inputflinger/reader/InputDevice.cpp"},"deprecated":false,"digest":{"line_hashes":["322196983521990433965624430675091414647","80965299658466156122458259694924224005","153113124037282638225651903512842122652","29409469658317615188667528105578559526"],"threshold":0.9},"id":"PUB-A-245770596-45812f31","match_only_versions":["13"],"signature_type":"Line","signature_version":"v1"},{"target":{"file":"services/inputflinger/tests/InputReader_test.cpp"},"deprecated":false,"digest":{"line_hashes":["85325383378175086860085602739175368590","56463877964196928586471274743889012909","88041511121116881537542246436872938226","204794543884339912463945908760304310176","33128417181640668815726635420522724010","225963408938731846172094010712332958878","117151405176810587249254317765095050577","245584103750874461101565668085380703659","270329216758505293355561989663111060634","42504417293994200147541221227789168993"],"threshold":0.9},"id":"PUB-A-245770596-76a9f035","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/6c57b2f55412a04a3a9d738af0185d0ca26f932f"},{"target":{"file":"services/inputflinger/reader/controller/PeripheralController.cpp"},"deprecated":false,"digest":{"line_hashes":["85182197222175915942110017132968736784"],"threshold":0.9},"id":"PUB-A-245770596-bd11de1b","match_only_versions":["13"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/6c57b2f55412a04a3a9d738af0185d0ca26f932f"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/6c57b2f55412a04a3a9d738af0185d0ca26f932f","target":{"file":"services/inputflinger/reader/controller/PeripheralController.h"},"deprecated":false,"digest":{"line_hashes":["296548616018877836004463619011968254286","76947339446701992052880826865506184841","222815987240578393504014922967957421141","215081228918708834555038855991838199085","217159935243666504103462474238379724227","24561548553475985129011704736701993154","146346602150037482227716396483101575568"],"threshold":0.9},"id":"PUB-A-245770596-c330bd5d","match_only_versions":["13"],"signature_type":"Line"},{"target":{"file":"services/inputflinger/reader/controller/PeripheralControllerInterface.h"},"deprecated":false,"digest":{"line_hashes":["284409104109870850002636175925968907331","37501889089987016421938931203134136795","196310911255903632192121915898919815199"],"threshold":0.9},"id":"PUB-A-245770596-e59c5d30","match_only_versions":["13"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/6c57b2f55412a04a3a9d738af0185d0ca26f932f"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-245770596.json"}}],"schema_version":"1.9.0"}