CVE-2022-20502

What it actually does

The vulnerability is a use-after-free condition caused by a stale cache entry in GetResolvedMethod within entrypoint_utils-inl.h, allowing a local attacker to read from previously freed memory regions and disclose sensitive information.

Why it matters to the business

Attackers with local access on affected Android devices can read sensitive user or system data without additional privileges or user interaction, increasing risk of information leakage on unpatched devices.

How an attack unfolds

An attacker installs or runs code locally on an Android device and invokes the affected method resolution path to trigger the stale cache, resulting in reads from freed memory that disclose information.

How to fix it

Apply the latest Android security patches addressing A-222166527 to resolve the stale cache in entrypoint_utils-inl.h; upgrade devices running Android-13 to a fixed release.

How to confirm the fix worked

Confirm devices are updated to a patched Android version beyond Android-13, review commit history for entrypoint_utils-inl.h changes, and perform targeted testing of method resolution to verify absence of use-after-free.

Typical attack path

1. Obtain local code execution on the device (for example via a malicious application)
2. Trigger method resolution through GetResolvedMethod with a stale cache entry
3. Read sensitive data from the use-after-free memory region

How to detect it

Examine system logs for crashes or anomalies during method resolution; review application installation and execution events for suspicious local processes, though local exploitation may produce limited artifacts.

What your security team should do

• Prioritize deployment of Android security updates to all managed devices
• Restrict sideloading and review application permissions to limit local execution vectors
• Monitor device patch levels and maintain an inventory of Android versions in the environment