{"schema_version":"1.9.0","id":"ASB-A-220261709","published":"2022-06-01T00:00:00Z","modified":"2026-09-10T15:43:18.983809180Z","aliases":["A-220261709","CVE-2022-24958"],"details":"In dev_config of inode.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2022-06-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/ff0000fe82f45","https://android.googlesource.com/kernel/common/+/590a98d5d1086","https://android.googlesource.com/kernel/common/+/c13159a588818","https://android.googlesource.com/kernel/common/+/fdd64084e4055"],"severity":"High","spl":"2022-06-05","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"100910238043098768575891757463404886640","length":2092},"id":"ASB-A-220261709-0c87b34c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/590a98d5d1086","target":{"file":"drivers/usb/gadget/legacy/inode.c","function":"dev_config","truncated_path_level":1}},{"deprecated":false,"digest":{"line_hashes":["186639761942567450573979788117275880424","333096429839334311930049144006513742060","60719391462526005632700289665433177534","317186749981178857477562520181006939674","54064079988113171740121196451130712801","43619927766329838885358180382763708978","79775120953513019826931127321861343923","132156066930817037200589357825327870347","218457760794979473464887387052798417883"],"threshold":0.9},"id":"ASB-A-220261709-383a2aa8","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/fdd64084e4055","target":{"file":"drivers/usb/gadget/legacy/inode.c","truncated_path_level":1}},{"deprecated":false,"digest":{"line_hashes":["186639761942567450573979788117275880424","333096429839334311930049144006513742060","60719391462526005632700289665433177534","317186749981178857477562520181006939674","54064079988113171740121196451130712801","43619927766329838885358180382763708978","79775120953513019826931127321861343923","132156066930817037200589357825327870347","218457760794979473464887387052798417883"],"threshold":0.9},"id":"ASB-A-220261709-6f47482d","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/590a98d5d1086","target":{"file":"drivers/usb/gadget/legacy/inode.c","truncated_path_level":1}},{"deprecated":false,"digest":{"function_hash":"100910238043098768575891757463404886640","length":2092},"id":"ASB-A-220261709-82a60387","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/c13159a588818","target":{"file":"drivers/usb/gadget/legacy/inode.c","function":"dev_config","truncated_path_level":1}},{"deprecated":false,"digest":{"line_hashes":["203430003165072718367858077295931742840","180273471412337465156164558445533312811","131691568141789193167961131358887418833","296795267979675987565603514620564612986","88886914578469651870350528706792891694","230937538168488276498676548176124459417"],"threshold":0.9},"id":"ASB-A-220261709-87ae7b2c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/ff0000fe82f45","target":{"file":"drivers/usb/gadget/legacy/inode.c","truncated_path_level":1}},{"deprecated":false,"digest":{"function_hash":"142784419688723226106187868832514389771","length":2152},"id":"ASB-A-220261709-af9535f3","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/ff0000fe82f45","target":{"file":"drivers/usb/gadget/legacy/inode.c","function":"dev_config","truncated_path_level":1}},{"deprecated":false,"digest":{"function_hash":"280494176015748101793496394995502174323","length":2122},"id":"ASB-A-220261709-c3d603db","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/fdd64084e4055","target":{"file":"drivers/usb/gadget/legacy/inode.c","function":"dev_config","truncated_path_level":1}},{"deprecated":false,"digest":{"line_hashes":["203430003165072718367858077295931742840","180273471412337465156164558445533312811","131691568141789193167961131358887418833","296795267979675987565603514620564612986","88886914578469651870350528706792891694","230937538168488276498676548176124459417"],"threshold":0.9},"id":"ASB-A-220261709-dbf6ae12","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/c13159a588818","target":{"file":"drivers/usb/gadget/legacy/inode.c","truncated_path_level":1}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-220261709.json"}}],"references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-06-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/ff0000fe82f45"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/590a98d5d1086"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/c13159a588818"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/fdd64084e4055"}]}