CVE-2022-20555 in Android
Summary
by MITRE • 12/16/2022
In ufdt_get_node_by_path_len of ufdt_convert.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-246194233
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/21/2026
The vulnerability identified as CVE-2022-20555 resides within the ufdt_get_node_by_path_len function in the ufdt_convert.c file of Android's unified device tree (UFD) implementation. This represents a critical out-of-bounds read condition that stems from insufficient input validation and missing bounds checking mechanisms. The flaw specifically affects Android 13 systems and is tracked under Android ID A-246194233, indicating its severity and the need for immediate attention in the mobile security landscape.
The technical nature of this vulnerability manifests when the ufdt_get_node_by_path_len function processes device tree node paths without adequate validation of array boundaries or string length parameters. This missing bounds check creates an exploitable condition where an attacker can manipulate input data to cause the function to read memory locations beyond the allocated buffer boundaries. The vulnerability requires system execution privileges for exploitation, meaning it can be leveraged by processes already running with elevated privileges, potentially allowing for information disclosure attacks that could reveal sensitive system data or memory contents.
From an operational impact perspective, this vulnerability presents a significant risk to Android 13 devices as it enables local information disclosure attacks that could expose confidential system information. The requirement for system execution privileges means that the vulnerability is most dangerous when exploited by malicious applications or processes that have already gained elevated access to the system, potentially allowing for further escalation or data exfiltration. The attack vector does not require user interaction, making it particularly concerning as it can be exploited automatically without any user awareness or consent.
Security practitioners should recognize this vulnerability as a classic example of CWE-129 Input Validation and the broader category of CWE-125 Out-of-bounds Read, which aligns with the ATT&CK technique T1059 Command and Scripting Interpreter for executing malicious code within the system. The vulnerability's classification as local information disclosure places it within the context of privilege escalation and data exposure threats. Mitigation strategies should include immediate patch deployment for Android 13 systems, implementation of additional input validation checks in the affected code paths, and monitoring for anomalous system behavior that might indicate exploitation attempts. Organizations should also consider implementing runtime protections and memory corruption detection mechanisms to reduce the attack surface and prevent successful exploitation of this vulnerability.