{"id":"ASB-A-230867044","details":"In io_match_task of io_uring.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-230867044","A-233078742","ASB-A-233078742","CVE-2022-1786"],"modified":"2026-03-11T06:04:30.942274Z","published":"2022-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-10-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/812805ff3b0c7"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/29f077d070519"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2022-10-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"spl":"2022-10-05","types":["EoP"],"vanir_signatures":[{"target":{"file":"fs/io_uring.c"},"deprecated":false,"source":"https://android.googlesource.com/kernel/common/+/29f077d070519","id":"ASB-A-230867044-109d8e6a","signature_type":"Line","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["272162681072718761223832810924314861088","282435767030736005459484303915207870642","77554876585778307774017004807339822970","222188109909390957259112931253691907692"]}},{"target":{"file":"fs/io_uring.c","function":"io_req_init_async"},"deprecated":false,"source":"https://android.googlesource.com/kernel/common/+/29f077d070519","id":"ASB-A-230867044-85e9891a","signature_type":"Function","signature_version":"v1","digest":{"function_hash":"227273210715688725373639114611586646087","length":305}},{"target":{"file":"fs/io_uring.c"},"deprecated":false,"source":"https://android.googlesource.com/kernel/common/+/812805ff3b0c7","id":"ASB-A-230867044-f53ab9c2","signature_type":"Line","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["272162681072718761223832810924314861088","282435767030736005459484303915207870642","77554876585778307774017004807339822970","222188109909390957259112931253691907692"]}},{"target":{"file":"fs/io_uring.c","function":"io_req_init_async"},"deprecated":false,"source":"https://android.googlesource.com/kernel/common/+/812805ff3b0c7","id":"ASB-A-230867044-fda9fe1a","signature_type":"Function","signature_version":"v1","digest":{"function_hash":"227273210715688725373639114611586646087","length":305}}],"fixes":["https://android.googlesource.com/kernel/common/+/812805ff3b0c7","https://android.googlesource.com/kernel/common/+/29f077d070519"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv-test/ASB-A-230867044.json"}}],"schema_version":"1.7.5"}