CVE-2022-20008

What it actually does

Uninitialized kernel heap memory in mmc_blk_read_single can be read when an SD card triggers read errors, enabling local information disclosure without privileges or user interaction.

Why it matters to the business

Sensitive kernel data may leak on Android devices, increasing risk of credential or key exposure on systems that rely on external storage.

How an attack unfolds

An attacker supplies or triggers an SD card that produces read errors during mmc_blk_read_single, causing the kernel to return uninitialized heap contents to user space.

How to fix it

Apply the upstream kernel patch referenced by Android ID A-216481035 and update to a patched Android kernel build; disable SD card support where feasible until fixed.

How to confirm the fix worked

Verify the presence of the fix in the mmc_blk_read_single function and confirm Android security patch level includes A-216481035.

Typical attack path

1. Provide or insert an SD card configured to generate read errors
2. Trigger mmc_blk_read_single via normal block I/O
3. Read resulting kernel heap memory disclosure

How to detect it

Monitor kernel logs for mmc_blk_read_single error paths and unexpected memory disclosures; correlate with physical SD card insertion events.

What your security team should do

• Prioritize kernel updates on all Android devices that support SD cards
• Restrict physical access to SD card slots on high-risk systems
• Review kernel logs for repeated MMC read errors as a potential trigger indicator