CVE-2022-20141

What it actually does

Use-after-free in ip_check_mc_rcu of igmp.c caused by improper locking when opening and closing inet sockets, enabling local privilege escalation.

Why it matters to the business

Attackers with local access on affected Android devices can obtain elevated system privileges, increasing risk of full device compromise on unpatched systems.

How an attack unfolds

An attacker repeatedly opens and closes inet sockets to trigger the race condition in IGMP RCU handling, then reuses the freed object to escalate privileges without user interaction.

How to fix it

Apply the latest Android kernel security patches that address the locking issue in igmp.c; upgrade devices to the patched Android versions as they become available from vendors.

How to confirm the fix worked

Verify kernel source contains the locking fix in ip_check_mc_rcu, confirm device kernel version matches or exceeds the patched release, and test socket open/close sequences under load for absence of UAF.

Typical attack path

1. Open inet socket
2. Trigger concurrent IGMP operations to induce improper locking
3. Close socket to free object while still referenced
4. Reuse freed memory to corrupt kernel structures
5. Escalate to root privileges

How to detect it

Review kernel logs and audit trails for repeated socket creation patterns around IGMP events; examine crash dumps for use-after-free signatures in igmp.c paths.

What your security team should do

• Prioritize patching all Android devices to the latest vendor kernel
• Restrict local user accounts and limit untrusted app execution where possible
• Monitor for downstream kernel updates in custom Android builds