CVE-2022-20009

MEDIUM

Android - Local Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2022-20009. PoCs published by szymonh.

AI-analyzed exploit summary This repository contains a proof-of-concept exploit for CVE-2022-20009, targeting multiple Android USB gadget drivers. The exploit demonstrates buffer overflow vulnerabilities in EP0 control transfer handlers, allowing attackers to overflow a 4096-byte buffer by manipulating the wLength field in USB control requests.

Description

In various functions of the USB gadget subsystem, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-213172319References: Upstream kernel

Exploits (1)

nomisec WORKING POC 3 stars
by szymonh · poc
https://github.com/szymonh/android-gadget

This repository contains a proof-of-concept exploit for CVE-2022-20009, targeting multiple Android USB gadget drivers. The exploit demonstrates buffer overflow vulnerabilities in EP0 control transfer handlers, allowing attackers to overflow a 4096-byte buffer by manipulating the wLength field in USB control requests.

Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel USB gadget drivers in Android (specific versions affected by CVE-2022-20009)
No auth needed
Prerequisites: Physical or logical access to the target device's USB interface · Target device running a vulnerable kernel version
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Patch, Vendor Advisory x_refsource_misc
https://source.android.com/security/bulletin/2022-05-01

Scores

CVSS v3 6.8
EPSS 0.0033
EPSS Percentile 24.7%
Attack Vector PHYSICAL
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (1)
google/android
Published May 10, 2022
Tracked Since Feb 18, 2026