{"id":"PUB-A-165329981","details":"In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-165329981","CVE-2022-20566"],"modified":"2026-03-11T06:32:56.959838Z","published":"2022-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-12-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/cacbff013baa586c63dd779e67d13238bf46c28e"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/2f9fed9ce805cf4d97cffb2f59d57b41b8e7fca8"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2022-12-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/kernel/common/+/cacbff013baa586c63dd779e67d13238bf46c28e","https://android.googlesource.com/kernel/common/+/2f9fed9ce805cf4d97cffb2f59d57b41b8e7fca8"],"severity":"Moderate","spl":"2022-12-05","vanir_signatures":[{"signature_version":"v1","id":"PUB-A-165329981-008c216e","source":"https://android.googlesource.com/kernel/common/+/cacbff013baa586c63dd779e67d13238bf46c28e","signature_type":"Function","digest":{"length":684,"function_hash":"236184558604859907890195847617279485217"},"deprecated":false,"target":{"function":"l2cap_global_fixed_chan","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-08b89494","source":"https://android.googlesource.com/kernel/common/+/2f9fed9ce805cf4d97cffb2f59d57b41b8e7fca8","signature_type":"Line","digest":{"line_hashes":["70052371497910363662595951109062678329","337061332846076623473359281743931350106","217879823638137958165958020238831858688","72040229481076319132831099242657120195","101597133732770256055318878809561157482","303561820771719152358755010052162886056","257653950157134822220463805679247036442","114182253712265871766091095197099081481","86595860156610740353243353575313159397","48142415019002605960104236140377002568","18744282258843389086756724125312433257","191079300490990689478647859609030500312","237214904194788848046362180974833816484","168031767303701785497431940315819895666","257653950157134822220463805679247036442","114182253712265871766091095197099081481","325688423038389291614889928612465727078","191318019539647406371420648045248760293","2955905199175656753399295565805406962","257653950157134822220463805679247036442","114182253712265871766091095197099081481","238472441875272254519810817357263784080","56948763213005278067600845525623793096","72804135579423131087516625699687592983","200890070817865003719855077513327449152","138511553115973135798595491151860354583","161983096754335581166449288280284248967","125482890884208964928776078001916239942","228409899296021516305131177616460472916","332517880528094785432212120000450246654","252106832695418794203906737005432217558","7204354057437989426729187786938084901","243485534346418610057370817139753213709","16525523788510581006198211558858793602","283440715391428972294928590994664543117","75013392573142557257956830170013943298","170712417529520927614119901577594341015","229574711092578775445605274744298600789","36327256003142729184034806516486343041","232824146620990207781904072140426834762","247376737163697878365143604352448763220","4978020118297755881522833624838059974","231931730848045378099010862674867520791","198723513729386649953838087574509623618","186388562770850213705140100075087488114","331013014655702106374031397158710486904","138449420069489977211070727048512907907","166550988820766545246873106038542502824","38794564904733421890641104769373163263","152181720647265497373043658600055051392","325396152028156461825976257373039032529","172057274404499640004844494401782128088","310874111164730573362982317096044176949","62827672749266796208414640029684124124","247598031375683136712725974857367268741","323441366845744466425933865993533941522","235917065999623988556121297506564092275","219605440815208519170284114749590822570","192952928898073677306992312819016189314","237170270618117431554387423058569691529","108221181523209078242625057465512956872","283740707775816795627136730923862105839","85118346703785761042849234380004478538","129448913717868222228038971857395864841","232063696138880623073490351999167961196","224006478562920050165307401675152943717","164032274340378248967914117419341465733","200010957122501598567493033751468745424","155501657650083700075550023143806863770","28607700834679470116460068699821432338","9409161176140457356294099072420017004","88156764865636144428759626619054907381","1557235551019568454495899749445222562","125701986548873720645685049004343239488","152344569035925649442338615303321596426","295845236815881542153463637686892873528","125482890884208964928776078001916239942"],"threshold":0.9},"deprecated":false,"target":{"file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-09a6aac2","source":"https://android.googlesource.com/kernel/common/+/cacbff013baa586c63dd779e67d13238bf46c28e","signature_type":"Function","digest":{"length":756,"function_hash":"32034523913324761511017111846052149146"},"deprecated":false,"target":{"function":"l2cap_move_channel_confirm","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-09ca4780","source":"https://android.googlesource.com/kernel/common/+/2f9fed9ce805cf4d97cffb2f59d57b41b8e7fca8","signature_type":"Function","digest":{"length":479,"function_hash":"331169585127603187152899612967911286855"},"deprecated":false,"target":{"function":"l2cap_move_fail","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-0a7b3cf8","source":"https://android.googlesource.com/kernel/common/+/2f9fed9ce805cf4d97cffb2f59d57b41b8e7fca8","signature_type":"Function","digest":{"length":2017,"function_hash":"58460502743198326917602840156688003226"},"deprecated":false,"target":{"function":"l2cap_move_channel_req","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-0f745a93","source":"https://android.googlesource.com/kernel/common/+/cacbff013baa586c63dd779e67d13238bf46c28e","signature_type":"Function","digest":{"length":905,"function_hash":"3503208812123310796551537278114468196"},"deprecated":false,"target":{"function":"l2cap_global_chan_by_psm","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-154254ac","source":"https://android.googlesource.com/kernel/common/+/2f9fed9ce805cf4d97cffb2f59d57b41b8e7fca8","signature_type":"Function","digest":{"length":2200,"function_hash":"319372398536614390432170082504835606501"},"deprecated":false,"target":{"function":"l2cap_config_rsp","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-2049bf95","source":"https://android.googlesource.com/kernel/common/+/cacbff013baa586c63dd779e67d13238bf46c28e","signature_type":"Function","digest":{"length":714,"function_hash":"203706653729299552482163804131010950435"},"deprecated":false,"target":{"function":"l2cap_le_credits","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-249a7e86","source":"https://android.googlesource.com/kernel/common/+/cacbff013baa586c63dd779e67d13238bf46c28e","signature_type":"Function","digest":{"length":1095,"function_hash":"235264457036944140079831474464566892112"},"deprecated":false,"target":{"function":"l2cap_data_channel","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-28158e26","source":"https://android.googlesource.com/kernel/common/+/2f9fed9ce805cf4d97cffb2f59d57b41b8e7fca8","signature_type":"Function","digest":{"length":756,"function_hash":"32034523913324761511017111846052149146"},"deprecated":false,"target":{"function":"l2cap_move_channel_confirm","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-3ba3321b","source":"https://android.googlesource.com/kernel/common/+/cacbff013baa586c63dd779e67d13238bf46c28e","signature_type":"Function","digest":{"length":2017,"function_hash":"58460502743198326917602840156688003226"},"deprecated":false,"target":{"function":"l2cap_move_channel_req","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-424e4c4b","source":"https://android.googlesource.com/kernel/common/+/cacbff013baa586c63dd779e67d13238bf46c28e","signature_type":"Function","digest":{"length":223,"function_hash":"3648122761785644288295746387316296666"},"deprecated":false,"target":{"function":"l2cap_get_chan_by_ident","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-4b803dfd","source":"https://android.googlesource.com/kernel/common/+/cacbff013baa586c63dd779e67d13238bf46c28e","signature_type":"Function","digest":{"length":223,"function_hash":"3648122761785644288295746387316296666"},"deprecated":false,"target":{"function":"l2cap_get_chan_by_scid","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-57619a71","source":"https://android.googlesource.com/kernel/common/+/cacbff013baa586c63dd779e67d13238bf46c28e","signature_type":"Line","digest":{"line_hashes":["141999440497785936613803119296706828159","140944776253181203670343956983069703796","333688976810559815526936408400622839196","57385169606919542335611207096156115085"],"threshold":0.9},"deprecated":false,"target":{"file":"include/net/bluetooth/l2cap.h"}},{"signature_version":"v1","id":"PUB-A-165329981-695d8a8a","source":"https://android.googlesource.com/kernel/common/+/2f9fed9ce805cf4d97cffb2f59d57b41b8e7fca8","signature_type":"Function","digest":{"length":714,"function_hash":"203706653729299552482163804131010950435"},"deprecated":false,"target":{"function":"l2cap_le_credits","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-6b3fa9f6","source":"https://android.googlesource.com/kernel/common/+/2f9fed9ce805cf4d97cffb2f59d57b41b8e7fca8","signature_type":"Line","digest":{"line_hashes":["141999440497785936613803119296706828159","140944776253181203670343956983069703796","333688976810559815526936408400622839196","57385169606919542335611207096156115085"],"threshold":0.9},"deprecated":false,"target":{"file":"include/net/bluetooth/l2cap.h"}},{"signature_version":"v1","id":"PUB-A-165329981-6d2fcb8b","source":"https://android.googlesource.com/kernel/common/+/2f9fed9ce805cf4d97cffb2f59d57b41b8e7fca8","signature_type":"Function","digest":{"length":905,"function_hash":"3503208812123310796551537278114468196"},"deprecated":false,"target":{"function":"l2cap_global_chan_by_psm","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-795d0cc8","source":"https://android.googlesource.com/kernel/common/+/cacbff013baa586c63dd779e67d13238bf46c28e","signature_type":"Line","digest":{"line_hashes":["70052371497910363662595951109062678329","337061332846076623473359281743931350106","217879823638137958165958020238831858688","72040229481076319132831099242657120195","101597133732770256055318878809561157482","303561820771719152358755010052162886056","257653950157134822220463805679247036442","114182253712265871766091095197099081481","86595860156610740353243353575313159397","48142415019002605960104236140377002568","18744282258843389086756724125312433257","191079300490990689478647859609030500312","237214904194788848046362180974833816484","168031767303701785497431940315819895666","257653950157134822220463805679247036442","114182253712265871766091095197099081481","325688423038389291614889928612465727078","191318019539647406371420648045248760293","2955905199175656753399295565805406962","257653950157134822220463805679247036442","114182253712265871766091095197099081481","223162794228136423629098889202545907193","56948763213005278067600845525623793096","7604269317727405148366733910418302022","200890070817865003719855077513327449152","138511553115973135798595491151860354583","161983096754335581166449288280284248967","125482890884208964928776078001916239942","228409899296021516305131177616460472916","332517880528094785432212120000450246654","252106832695418794203906737005432217558","7204354057437989426729187786938084901","243485534346418610057370817139753213709","16525523788510581006198211558858793602","283440715391428972294928590994664543117","75013392573142557257956830170013943298","170712417529520927614119901577594341015","229574711092578775445605274744298600789","36327256003142729184034806516486343041","232824146620990207781904072140426834762","247376737163697878365143604352448763220","4978020118297755881522833624838059974","231931730848045378099010862674867520791","198723513729386649953838087574509623618","186388562770850213705140100075087488114","331013014655702106374031397158710486904","138449420069489977211070727048512907907","166550988820766545246873106038542502824","38794564904733421890641104769373163263","152181720647265497373043658600055051392","325396152028156461825976257373039032529","172057274404499640004844494401782128088","310874111164730573362982317096044176949","62827672749266796208414640029684124124","247598031375683136712725974857367268741","323441366845744466425933865993533941522","235917065999623988556121297506564092275","219605440815208519170284114749590822570","192952928898073677306992312819016189314","237170270618117431554387423058569691529","108221181523209078242625057465512956872","283740707775816795627136730923862105839","85118346703785761042849234380004478538","129448913717868222228038971857395864841","232063696138880623073490351999167961196","224006478562920050165307401675152943717","164032274340378248967914117419341465733","200010957122501598567493033751468745424","155501657650083700075550023143806863770","28607700834679470116460068699821432338","9409161176140457356294099072420017004","88156764865636144428759626619054907381","1557235551019568454495899749445222562","125701986548873720645685049004343239488","152344569035925649442338615303321596426","295845236815881542153463637686892873528","125482890884208964928776078001916239942"],"threshold":0.9},"deprecated":false,"target":{"file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-79960a7f","source":"https://android.googlesource.com/kernel/common/+/2f9fed9ce805cf4d97cffb2f59d57b41b8e7fca8","signature_type":"Function","digest":{"length":223,"function_hash":"3648122761785644288295746387316296666"},"deprecated":false,"target":{"function":"l2cap_get_chan_by_ident","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-7c0b7239","source":"https://android.googlesource.com/kernel/common/+/cacbff013baa586c63dd779e67d13238bf46c28e","signature_type":"Function","digest":{"length":1397,"function_hash":"330173890241000632968311811768631592144"},"deprecated":false,"target":{"function":"l2cap_move_continue","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-7f5df5e2","source":"https://android.googlesource.com/kernel/common/+/2f9fed9ce805cf4d97cffb2f59d57b41b8e7fca8","signature_type":"Function","digest":{"length":1095,"function_hash":"235264457036944140079831474464566892112"},"deprecated":false,"target":{"function":"l2cap_data_channel","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-8ed77ded","source":"https://android.googlesource.com/kernel/common/+/2f9fed9ce805cf4d97cffb2f59d57b41b8e7fca8","signature_type":"Function","digest":{"length":1397,"function_hash":"330173890241000632968311811768631592144"},"deprecated":false,"target":{"function":"l2cap_move_continue","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-aaa0ed59","source":"https://android.googlesource.com/kernel/common/+/2f9fed9ce805cf4d97cffb2f59d57b41b8e7fca8","signature_type":"Function","digest":{"length":2232,"function_hash":"118869981950018905847546501991015473393"},"deprecated":false,"target":{"function":"l2cap_config_req","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-ab53e14b","source":"https://android.googlesource.com/kernel/common/+/cacbff013baa586c63dd779e67d13238bf46c28e","signature_type":"Function","digest":{"length":2232,"function_hash":"118869981950018905847546501991015473393"},"deprecated":false,"target":{"function":"l2cap_config_req","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-ae711fe3","source":"https://android.googlesource.com/kernel/common/+/cacbff013baa586c63dd779e67d13238bf46c28e","signature_type":"Function","digest":{"length":223,"function_hash":"3648122761785644288295746387316296666"},"deprecated":false,"target":{"function":"l2cap_get_chan_by_dcid","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-bac13bc5","source":"https://android.googlesource.com/kernel/common/+/2f9fed9ce805cf4d97cffb2f59d57b41b8e7fca8","signature_type":"Function","digest":{"length":223,"function_hash":"3648122761785644288295746387316296666"},"deprecated":false,"target":{"function":"l2cap_get_chan_by_scid","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-c21af74a","source":"https://android.googlesource.com/kernel/common/+/cacbff013baa586c63dd779e67d13238bf46c28e","signature_type":"Function","digest":{"length":568,"function_hash":"83830462002002839983715304866302848239"},"deprecated":false,"target":{"function":"l2cap_move_channel_confirm_rsp","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-c56a62c2","source":"https://android.googlesource.com/kernel/common/+/2f9fed9ce805cf4d97cffb2f59d57b41b8e7fca8","signature_type":"Function","digest":{"length":568,"function_hash":"83830462002002839983715304866302848239"},"deprecated":false,"target":{"function":"l2cap_move_channel_confirm_rsp","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-cd40474f","source":"https://android.googlesource.com/kernel/common/+/cacbff013baa586c63dd779e67d13238bf46c28e","signature_type":"Function","digest":{"length":2226,"function_hash":"141941887257596437627066361646638695503"},"deprecated":false,"target":{"function":"l2cap_config_rsp","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-d201f4ff","source":"https://android.googlesource.com/kernel/common/+/cacbff013baa586c63dd779e67d13238bf46c28e","signature_type":"Function","digest":{"length":479,"function_hash":"331169585127603187152899612967911286855"},"deprecated":false,"target":{"function":"l2cap_move_fail","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-d4af7850","source":"https://android.googlesource.com/kernel/common/+/2f9fed9ce805cf4d97cffb2f59d57b41b8e7fca8","signature_type":"Function","digest":{"length":684,"function_hash":"236184558604859907890195847617279485217"},"deprecated":false,"target":{"function":"l2cap_global_fixed_chan","file":"net/bluetooth/l2cap_core.c"}},{"signature_version":"v1","id":"PUB-A-165329981-e0182cd7","source":"https://android.googlesource.com/kernel/common/+/2f9fed9ce805cf4d97cffb2f59d57b41b8e7fca8","signature_type":"Function","digest":{"length":223,"function_hash":"3648122761785644288295746387316296666"},"deprecated":false,"target":{"function":"l2cap_get_chan_by_dcid","file":"net/bluetooth/l2cap_core.c"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv-test/PUB-A-165329981.json"}}],"schema_version":"1.7.5"}