A security update for December has been released by Google for Android that addresses 4 critical severity vulnerabilities. An additional 16 critical flaws have been patched in a Pixel update that has been released for Google Pixel devices. These 16 additional vulnerabilities patched are elevation of privilege flaws found in Pixel firmware, and LDFW, TF-A, and libfdt subcomponents.  

Two of the critical severity flaws patched in this update are remote code execution vulnerabilities found in the Android Framework. CVE-2022-20472 and CVE-2022-20473 have both been assigned a CVSS base score of 9.8, and affect Android versions 10, 11, 12, 12-L, and 13. Attackers can exploit these flaws due to an incorrect bounds check allowing for an out of bounds read in the toLanguageTag of LocaleListCache.cpp. An exploit of these vulnerabilities can lead to remote code execution without the attacker requiring any user interaction or additional privileges for code execution.  

The other two critical flaws occur in the System components, however despite their severity rating by Android in their security bulletin, neither of these flaws are rated as critical by NIST and are assigned much lower CVSS base scores. CVE-2022-20411 is a remote code execution vulnerability that has been assigned a CVSS base score of 8.8 and a high severity rating. This flaw is due to a missing bounds check that can lead to an out of bound write in the avdt_msg_asmbl of avdt_msg.cc. An attacker could exploit this vulnerability over Bluetooth, with no user interaction or additional privileges needed in order to execute arbitrary code.  

CVE-2022-20498 is an information disclosure vulnerability with an even lower CVSS base score of 4.4, and a medium severity rating. This vulnerability is also due to incorrect bounds checking, leading to a possible out of bounds read. No user interaction is required for an exploit of this flaw, however System execution privileges are needed to exploit local information disclosure, hence the lower severity rating.  

Users should receive notifications from Google when updates are available for their devices, however the version can be manually found by going into the Settings app, then tapping About phone, then Android version. This shows the Android version, security updates, and build number for the device. The December updates released are found in patch level 2022-12-05 and later.