CVE-2022-20572

What it actually does

Missing permission check in verity_target of dm-verity-target.c allows modification of read-only files protected by dm-verity when System execution privileges are already held.

Why it matters to the business

Attackers who already possess elevated local access can alter protected system files, undermining device integrity controls and potentially enabling further compromise across Android deployments.

How an attack unfolds

An attacker with System-level access invokes the flawed verity_target path to bypass the intended read-only enforcement of dm-verity, directly writing to protected blocks without additional user interaction or kernel privileges beyond those already obtained.

How to fix it

Apply the upstream kernel patch referenced by Android ID A-234475629 and update to a patched Android kernel build that enforces the missing permission check in dm-verity-target.c.

How to confirm the fix worked

Confirm the presence of the upstream fix in dm-verity-target.c, verify that read-only dm-verity targets reject unauthorized writes under System context, and test on updated Android kernel builds.

Typical attack path

1. Obtain System execution privileges on the target Android device
2. Trigger the verity_target function in dm-verity-target.c with a crafted request
3. Exploit the absent permission check to write to dm-verity-protected blocks
4. Modify read-only files to alter system behavior or persist changes

How to detect it

Review kernel logs and dm-verity audit events for unexpected writes to read-only targets; correlate with process activity holding System privileges around the time of file modification.

What your security team should do

• Prioritize kernel updates for all Android devices as soon as vendor patches become available
• Monitor EPSS trend and any future KEV additions given the 32% score increase over 30 days
• Audit custom kernels and downstream Android derivatives for the missing permission check