CVE-2022-20369

What it actually does

Out-of-bounds write in the v4l2_m2m_querybuf function of v4l2-mem2mem.c caused by missing input validation, allowing memory corruption when System-level privileges are already held.

Why it matters to the business

Attackers who already possess elevated access on affected Android or Linux systems can gain full kernel control, leading to complete device or server compromise, data theft, or persistence; the issue remains unpatched in many long-running deployments more than four years after disclosure.

How an attack unfolds

An attacker with System execution rights supplies a crafted buffer to the video4linux memory-to-memory querybuf handler; improper size validation writes attacker-controlled data past the intended allocation, corrupting kernel structures to escalate from System to full root or ring-0 privileges.

How to fix it

Apply the upstream kernel commit that adds proper bounds checking to v4l2_m2m_querybuf; rebuild and deploy updated kernels to all affected Android devices and Debian Linux systems; where updates are unavailable, restrict access to the v4l2_m2m device nodes to only trusted processes.

How to confirm the fix worked

Verify that the v4l2_m2m_querybuf function in the running kernel contains the upstream bounds check; confirm that /dev/video* nodes are not world-accessible; run kernel memory-safety test suites exercising v4l2 querybuf paths.

Typical attack path

1. Obtain System-level execution on the target (via another vulnerability or insider access)
2. Load or invoke the v4l2_m2m interface with a maliciously sized querybuf structure
3. Trigger the out-of-bounds write to corrupt adjacent kernel memory
4. Leverage the corruption to overwrite credentials, function pointers, or page tables
5. Execute arbitrary code with kernel privileges

How to detect it

Review kernel audit logs and dmesg for unusual v4l2_m2m activity or memory corruption warnings around the time of suspected compromise; search process execution history for unexpected use of video4linux ioctls by non-media applications.

What your security team should do

• Prioritize kernel upgrades on all Android and Debian hosts that expose v4l2_m2m
• Audit device-node permissions and remove unnecessary System-level access to video4linux drivers
• Monitor EPSS trend and any new exploit maturity announcements despite currently low scores
• Include the affected kernel versions in asset inventories for rapid patching once fixes appear