CVE-2022-0247 HIGH

CVE-2022-0247: Write access to VMO data through copy-on-write in Fuchsia

Vendor Google Llc

Product Fuchsia

Weakness CWE-732

Published February 25, 2022

Last update April 21, 2025

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Local

Attack complexity High

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

What the vulnerability does

01Description

An issue exists in Fuchsia where VMO data can be modified through access to copy-on-write snapshots. A local attacker could modify objects in the VMO that they do not have permission to. We recommend upgrading past commit d97c05d2301799ed585620a9c5c739d36e7b5d3d or any of the listed versions.

Key dates

02Disclosure timeline

February 25, 2022 CVE published

April 21, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-0247 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/732.html

Related vulnerabilities

04Related CVE

CVE-2019-14824 CVE-2024-1486 Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices CVE-2025-34288 Nagios XI Privilege Escalation via Writable PHP Include Executed with Sudo CVE-2024-24912 Local privilege escalation in Harmony Endpoint Security Client for Windows via crafted DLL file CVE-2025-20386 Incorrect permission assignment on Splunk Enterprise for Windows during new installation or upgrade