{"vulnerability": "CVE-2022-20454", "sightings": [{"uuid": "7618b3fe-aa65-4558-a01a-8ea7fdad4978", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-20454", "type": "seen", "source": "https://t.me/itsec_news/2248", "content": "\u200b\u26a1\ufe0f Google \u0434\u0435\u043b\u0430\u0435\u0442 \u0441\u0444\u0435\u0440\u0443 \u043f\u043e\u0438\u0441\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432\u0441\u0451 \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0433\u043e\u0434\u043d\u043e\u0439 \u0434\u043b\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\ud83d\udcac \u0412 \u0440\u0430\u043c\u043a\u0430\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f \u0437\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (\u00abBug Bounty\u00bb) \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u0432\u044b\u043f\u043b\u0430\u0442\u0438\u043b\u0430 \u0441\u0430\u043c\u0443\u044e \u0432\u044b\u0441\u043e\u043a\u0443\u044e \u043d\u0430\u0433\u0440\u0430\u0434\u0443 \u0432 \u0438\u0441\u0442\u043e\u0440\u0438\u0438 \u2014 \u043e\u043a\u043e\u043b\u043e 12 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432 \u0437\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 2900 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\n\n\u0421\u0430\u043c\u0430\u044f \u043a\u0440\u0443\u043f\u043d\u0430\u044f \u0432\u044b\u043f\u043b\u0430\u0442\u0430 \u0432 2022 \u0433\u043e\u0434\u0443 \u0431\u044b\u043b\u0430 \u0437\u0430 \u043e\u0442\u0447\u0451\u0442, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u043b\u0430\u0441\u044c \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0438\u0437 \u043f\u044f\u0442\u0438 Android-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (CVE-2022-20427, CVE-2022-20428, CVE-2022-20454, CVE-2022-20459, CVE-2022-20460). \u041e\u0442\u0447\u0451\u0442 \u0431\u044b\u043b \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0431\u0430\u0433\u0445\u0430\u043d\u0442\u0435\u0440\u043e\u043c \u043f\u043e\u0434 \u043d\u0438\u043a\u043e\u043c \u00abgzobqq\u00bb, \u0437\u0430 \u043d\u0435\u0433\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b 605 \u0442\u044b\u0441\u044f\u0447 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432.\n\n\u0412 2021 \u0433\u043e\u0434\u0443 \u0442\u043e\u0442 \u0436\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u0438 \u0441\u043e\u043e\u0431\u0449\u0438\u043b \u043e \u0434\u0440\u0443\u0433\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 Android-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b 157 \u0442\u044b\u0441\u044f\u0447 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432 \u2014 \u0442\u043e\u0436\u0435 \u0441\u0430\u043c\u0443\u044e \u0432\u044b\u0441\u043e\u043a\u0443\u044e \u043d\u0430\u0433\u0440\u0430\u0434\u0443 \u043d\u0430 \u0442\u043e\u0442 \u043c\u043e\u043c\u0435\u043d\u0442.\n\n\u041e\u0431\u044b\u0447\u043d\u043e \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0435 \u0437\u0430 Android-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 Google VRP, \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0434\u043e 10 \u0442\u044b\u0441\u044f\u0447 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432. \u041e\u0434\u043d\u0430\u043a\u043e \u0437\u0430 \u0446\u0435\u043b\u044b\u0435 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u043f\u043b\u0430\u0442\u0438\u0442\u044c \u0432\u043f\u043b\u043e\u0442\u044c \u0434\u043e 1 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u0430 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432. \u0421\u0443\u043c\u043c\u0430\u0440\u043d\u043e \u0438\u043c\u0435\u043d\u043d\u043e \u043d\u0430 \u0434\u043e\u043b\u044e Android-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u0440\u0438\u0448\u043b\u043e\u0441\u044c 4,8 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432 \u0432\u044b\u043f\u043b\u0430\u0442 \u0432 2022 \u0433\u043e\u0434\u0443.\n\n\u0422\u0430\u043a\u0436\u0435 \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0432\u044b\u043f\u043b\u0430\u0442\u0438\u043b\u0430 \u043e\u043a\u043e\u043b\u043e 4 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432 \u0437\u0430 \u043d\u0430\u0439\u0434\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 Chrome (\u043e\u043a\u043e\u043b\u043e 360 \u0448\u0442) \u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 ChromeOS (\u043e\u043a\u043e\u043b\u043e 110 \u0448\u0442).\n\n\u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0439 \u0437\u0430 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c, \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u0430\u044f Google \u0432 \u0430\u0432\u0433\u0443\u0441\u0442\u0435 2022 \u0433\u043e\u0434\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u0430 \u0431\u043e\u043b\u0435\u0435 100 \u0431\u0430\u0433\u0445\u0430\u043d\u0442\u0435\u0440\u0430\u043c \u0441\u0443\u043c\u043c\u0430\u0440\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0431\u043e\u043b\u0435\u0435 110 \u0442\u044b\u0441\u044f\u0447 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432.\n\n\u041f\u043e\u043c\u0438\u043c\u043e \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0439, \u0432\u044b\u043f\u043b\u0430\u0447\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c, Google \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u0434\u0435\u043b\u0438\u043b\u0430 \u0431\u043e\u043b\u0435\u0435 250 \u0442\u044b\u0441\u044f\u0447 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432 \u0432 \u0432\u0438\u0434\u0435 \u0433\u0440\u0430\u043d\u0442\u043e\u0432 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 170 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c. \u042d\u0442\u0438 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u044b \u0434\u043b\u044f \u0447\u0430\u0441\u0442\u043d\u044b\u0445 \u043b\u0438\u0446, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043b\u0435\u0434\u044f\u0442 \u0437\u0430 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u043c\u0438 \u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438 Google, \u0434\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u043e\u043d\u0438 \u043d\u0435 \u043d\u0430\u0445\u043e\u0434\u044f\u0442 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 Google \u0442\u0430\u043a\u0436\u0435 \u0431\u044b\u043b\u0430 \u0441\u043f\u043e\u043d\u0441\u043e\u0440\u043e\u043c \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0439 NahamCon \u0438 BountyCon, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e.\n\n\u0418\u043d\u044b\u043c\u0438 \u0441\u043b\u043e\u0432\u0430\u043c\u0438, Google \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0432\u0441\u0451 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0435, \u0447\u0442\u043e\u0431\u044b \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u043e\u0442\u0440\u0430\u0441\u043b\u044c \u043f\u043e\u0438\u0441\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e \u0432\u044b\u0433\u043e\u0434\u043d\u043e\u0439. \u0421\u0432\u043e\u0438\u043c\u0438 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f\u043c\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u00ab\u0431\u0435\u043b\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432\u00bb \u0438 \u0434\u0435\u043b\u0430\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0435 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0433\u043e\u0440\u0430\u0437\u0434\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0435\u0435.\n\n#Google #\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\n\n\ud83d\udd14 ITsec NEWS", "creation_timestamp": "2023-02-23T09:34:32.000000Z"}, {"uuid": "7f4ad24c-64db-4e42-a99e-77d49e167a41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-20454", "type": "seen", "source": "https://gist.github.com/Daniel-Pereira-Linux/2ab9fd72e0d6bd2f06ef4c920b17219e", "content": "# Security Advisory: OOB read/write in libfdt overlay application via unchecked `__local_fixups__` offsets\n\n- **Discovered by:** Daniel Pereira \n- **Component:** libfdt (Device Tree Compiler / dtc), `libfdt/fdt_overlay.c`\n- **Affected:** `dgibson/dtc` main branch (verified at commit `7a1e017`) and the\n  copy vendored as `scripts/dtc/libfdt` in the Linux source tree.\n- **NOT affected:** the Linux kernel *runtime* overlay path (`drivers/of/`),\n  which is a separate implementation.\n- **Type:** CWE-787 Out-of-bounds Write, CWE-125 Out-of-bounds Read\n- **Status:** confirmed by upstream maintainer (David Gibson) on 2026-09-20.\n- **Fix:** see `0001-libfdt-overlay-bounds-check-__local_fixups__-offsets.patch`\n\n## Summary\n\nWhen libfdt applies a device-tree overlay, it reads phandle-fixup offsets from\nthe overlay's `/__local_fixups__` node and uses each 32-bit offset to compute a\npointer into a target property, **without validating the offset against the\ntarget property length**. A crafted overlay therefore yields an out-of-bounds\nread and a conditional 4-byte out-of-bounds write relative to the overlay blob.\n\n`FDT_RO_PROBE` only validates the header and structural block bounds \u2014 it does\n**not** validate `/__local_fixups__` offset values.\n\n## Vulnerable code\n\n`libfdt/fdt_overlay.c`, two locations, both of the form:\n\n```c\nrefp = (fdt32_t *)(tree_val + fdt32_ld_(fixup_val + i));  /* offset unchecked */\n```\n\n1. `overlay_update_local_node_references()` \u2014 OOB read + unconditional OOB write:\n\n   ```c\n   refp = (fdt32_t *)(tree_val + fdt32_ld_(fixup_val + i));\n   fdt32_st(refp, fdt32_ld(refp) + delta);\n   ```\n\n2. `overlay_update_node_conflicting_references()` \u2014 OOB read + conditional OOB write:\n\n   ```c\n   refp = (fdt32_t *)(tree_val + fdt32_ld_(fixup_val + i));\n   valp = fdt32_ld(refp);\n   if (valp == fdto_phandle)\n           fdt32_st(refp, fdt_phandle);\n   ```\n\nIn both, `fdt32_ld_(fixup_val + i)` is an attacker-controlled `u32` taken\nverbatim from `/__local_fixups__`; nothing enforces\n`offset + sizeof(fdt32_t) <= tree_len`.\n\n## Reachability\n\nFrom `fdt_overlay_apply(fdt, fdto)`:\n\n- `overlay_update_local_references()` -> `overlay_update_local_node_references()`\n  \u2014 location (1); triggers for **any** `/__local_fixups__` entry.\n- `overlay_prevent_phandle_overwrite()` -> `overlay_update_node_conflicting_references()`\n  \u2014 location (2); triggers on a phandle conflict between overlay and base tree.\n\n## Impact and trust boundary\n\n4-byte out-of-bounds write at an attacker-controlled offset, plus out-of-bounds\nread, relative to the overlay blob \u2014 a heap-corruption primitive, not merely a\nmalformed-hardware description.\n\nThis crosses a real trust boundary wherever an overlay from an **untrusted**\nsource is applied on top of a **trusted** base with libfdt, notably:\n\n- **Bootloaders (e.g. U-Boot)** applying an **unsigned** overlay onto a\n  **signed** base device tree under verified/secure boot. The base is\n  authenticated; the overlay is attacker-controlled. \"Lying about the hardware\"\n  stays inside the device-tree model; an OOB write corrupts memory outside the\n  blob \u2014 a categorically stronger primitive.\n- The `fdtoverlay` command-line tool.\n- Any application linking libfdt that applies overlays from untrusted input.\n\n## Prior art\n\nNo prior CVE/report was found for this specific `/__local_fixups__` OOB. Known\nlibfdt CVEs are in unrelated functions (CVE-2022-20454 `fdt_next_tag`,\nCVE-2022-20498 `fdt_property`).\n\n## Provenance\n\nLocation (1) was introduced by commit `24f60011` (\"libfdt: Add phandle-based\nfixup functions\"); location (2) was copied from it.\n\n## Proof of concept\n\nA minimal overlay built with the libfdt sw (serial-write) API, containing a\n`/__local_fixups__` entry whose offset is e.g. `0x10000000`, drives\n`overlay_update_local_node_references()` to dereference `tree_val + 0x10000000`.\n(PoC / ASan trace available on request from the discoverer.)\n\n## Fix\n\nBounds check the offset against the target property length with an\noverflow-safe unsigned comparison before forming the pointer, rejecting the\noverlay with `-FDT_ERR_BADOVERLAY` otherwise. See attached patch.\n\n## Suggested CVSS (estimate)\n\nCVSS:3.1 **AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H** ~ **8.0 (High)** for the\nbootloader/secure-boot deployment. Score varies by consumer; for the offline\n`fdtoverlay` tool, UI:R lowers it. This is an estimate for the CNA to confirm.", "creation_timestamp": "2026-09-20T14:09:13.130418Z"}]}