Exploitation Summary
EIP tracks 1 public exploit for CVE-2022-20452. PoCs published by michalbednarski.
AI-analyzed exploit summary This repository contains a working proof-of-concept exploit for CVE-2022-20452, leveraging a Parcelable mismatch vulnerability in Android 13 to achieve remote code execution in system processes. The exploit demonstrates how to leak Binder objects and execute shellcode in privileged contexts.
Description
In initializeFromParcelLocked of BaseBundle.java, there is a possible method arbitrary code execution due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-240138318
Exploits (1)
This repository contains a working proof-of-concept exploit for CVE-2022-20452, leveraging a Parcelable mismatch vulnerability in Android 13 to achieve remote code execution in system processes. The exploit demonstrates how to leak Binder objects and execute shellcode in privileged contexts.
References (1)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H