ASB-A-152064592

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-152064592.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-152064592
Aliases
  • A-152064592
  • CVE-2021-0438
Published
2021-04-01T00:00:00Z
Modified
2026-07-10T15:26:01.587957612Z
Summary
[none]
Details

In several functions of InputDispatcher.cpp, WindowManagerService.java, and related files, there is a possible tapjacking attack due to an incorrect FLAG_OBSCURED value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

References

Affected packages

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
8.1:0
Fixed
8.1:2021-04-01

Affected versions

8.*
8.1

Ecosystem specific 

{
    "types": [
        "EoP"
    ],
    "spl": "2021-04-01",
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/9661bf7a40d33470bcd35f15758ab71c7c635c63"
    ],
    "severity": "High",
    "vanir_signatures": [
        {
            "target": {
                "function": "addWindow",
                "file": "services/core/java/com/android/server/wm/WindowManagerService.java"
            },
            "signature_version": "v1",
            "digest": {
                "function_hash": "245417364887964578931082778496842187324",
                "length": 11538.0
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/9661bf7a40d33470bcd35f15758ab71c7c635c63",
            "deprecated": false,
            "id": "ASB-A-152064592-01b10344"
        },
        {
            "target": {
                "function": "setView",
                "file": "core/java/android/view/ViewRootImpl.java"
            },
            "signature_version": "v1",
            "digest": {
                "function_hash": "120548723177840845919256656497900625926",
                "length": 6838.0
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/9661bf7a40d33470bcd35f15758ab71c7c635c63",
            "deprecated": false,
            "id": "ASB-A-152064592-2cc1f695"
        },
        {
            "target": {
                "file": "services/core/java/com/android/server/wm/WindowManagerService.java"
            },
            "signature_version": "v1",
            "digest": {
                "line_hashes": [
                    "191756847136270296369553763081771832688",
                    "106390184753104213513027313323794346740",
                    "114298727263903920143565307254917568216",
                    "85431566168118264752420830628812281522",
                    "162443295245741336675999627289494297403"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/9661bf7a40d33470bcd35f15758ab71c7c635c63",
            "deprecated": false,
            "id": "ASB-A-152064592-3070776d"
        },
        {
            "target": {
                "file": "core/java/android/view/InputChannel.java"
            },
            "digest": {
                "line_hashes": [
                    "144314963066041979339326556589679816627",
                    "26796930622200074222979280170233243811",
                    "63210466038713291057509881786749335701"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-152064592-4e9c5c27",
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/9661bf7a40d33470bcd35f15758ab71c7c635c63",
            "deprecated": false,
            "signature_version": "v1"
        },
        {
            "target": {
                "file": "core/java/android/view/ViewRootImpl.java"
            },
            "digest": {
                "line_hashes": [
                    "232764122002406498189910346406296609933",
                    "267461055333102777668738625415609828294",
                    "111687512615550132499321364881693223187",
                    "107793811789574803013945368211033877433",
                    "223813062959423223440481869870848888888",
                    "105268195857313583150489635476326296352",
                    "205111092423982176402492038393576354845",
                    "207096956224682607809407367494887235819",
                    "74757220120589641769880561030983441264",
                    "324669705019895517519890249251155226442",
                    "311504105775882186708492469294199040366"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-152064592-9b134427",
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/9661bf7a40d33470bcd35f15758ab71c7c635c63",
            "deprecated": false,
            "signature_version": "v1"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-152064592.json"

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
9:0
Fixed
9:2021-04-01

Affected versions

Other
9

Ecosystem specific 

{
    "types": [
        "EoP"
    ],
    "spl": "2021-04-01",
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/0fed2d8e7e2b9757c7c40cd445772d52398478b1"
    ],
    "severity": "High",
    "vanir_signatures": [
        {
            "target": {
                "function": "setView",
                "file": "core/java/android/view/ViewRootImpl.java"
            },
            "signature_version": "v1",
            "digest": {
                "function_hash": "154181737550920605205700378612111025202",
                "length": 7105.0
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/0fed2d8e7e2b9757c7c40cd445772d52398478b1",
            "deprecated": false,
            "id": "ASB-A-152064592-2b3012c7"
        },
        {
            "id": "ASB-A-152064592-59927bf6",
            "digest": {
                "line_hashes": [
                    "232764122002406498189910346406296609933",
                    "267461055333102777668738625415609828294",
                    "111687512615550132499321364881693223187",
                    "107793811789574803013945368211033877433",
                    "223813062959423223440481869870848888888",
                    "105268195857313583150489635476326296352",
                    "205111092423982176402492038393576354845",
                    "207096956224682607809407367494887235819",
                    "74757220120589641769880561030983441264",
                    "324669705019895517519890249251155226442",
                    "311504105775882186708492469294199040366"
                ],
                "threshold": 0.9
            },
            "signature_version": "v1",
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/0fed2d8e7e2b9757c7c40cd445772d52398478b1",
            "deprecated": false,
            "target": {
                "file": "core/java/android/view/ViewRootImpl.java"
            }
        },
        {
            "id": "ASB-A-152064592-84da5882",
            "digest": {
                "line_hashes": [
                    "144314963066041979339326556589679816627",
                    "26796930622200074222979280170233243811",
                    "63210466038713291057509881786749335701"
                ],
                "threshold": 0.9
            },
            "signature_version": "v1",
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/0fed2d8e7e2b9757c7c40cd445772d52398478b1",
            "deprecated": false,
            "target": {
                "file": "core/java/android/view/InputChannel.java"
            }
        },
        {
            "target": {
                "file": "services/core/java/com/android/server/wm/WindowManagerService.java"
            },
            "signature_version": "v1",
            "digest": {
                "line_hashes": [
                    "191756847136270296369553763081771832688",
                    "106390184753104213513027313323794346740",
                    "114298727263903920143565307254917568216",
                    "85431566168118264752420830628812281522",
                    "162443295245741336675999627289494297403"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/0fed2d8e7e2b9757c7c40cd445772d52398478b1",
            "deprecated": false,
            "id": "ASB-A-152064592-ca660a01"
        },
        {
            "id": "ASB-A-152064592-f1d7ea8d",
            "digest": {
                "function_hash": "150734779361418601709594417967709985204",
                "length": 11895.0
            },
            "signature_version": "v1",
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/0fed2d8e7e2b9757c7c40cd445772d52398478b1",
            "deprecated": false,
            "target": {
                "function": "addWindow",
                "file": "services/core/java/com/android/server/wm/WindowManagerService.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-152064592.json"

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
10:0
Fixed
10:2021-04-01

Affected versions

Other
10

Ecosystem specific 

{
    "types": [
        "EoP"
    ],
    "spl": "2021-04-01",
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/514b3297768f4a7469117a7005556663124040f9"
    ],
    "severity": "High",
    "vanir_signatures": [
        {
            "target": {
                "file": "services/core/java/com/android/server/wm/WindowManagerService.java"
            },
            "digest": {
                "line_hashes": [
                    "191756847136270296369553763081771832688",
                    "106390184753104213513027313323794346740",
                    "114298727263903920143565307254917568216",
                    "85431566168118264752420830628812281522",
                    "162443295245741336675999627289494297403"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-152064592-02ba8553",
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/514b3297768f4a7469117a7005556663124040f9",
            "deprecated": false,
            "signature_version": "v1"
        },
        {
            "target": {
                "file": "core/java/android/view/ViewRootImpl.java"
            },
            "signature_version": "v1",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "232764122002406498189910346406296609933",
                    "267461055333102777668738625415609828294",
                    "111687512615550132499321364881693223187",
                    "107793811789574803013945368211033877433",
                    "223813062959423223440481869870848888888",
                    "105268195857313583150489635476326296352",
                    "205111092423982176402492038393576354845",
                    "207096956224682607809407367494887235819",
                    "74757220120589641769880561030983441264",
                    "324669705019895517519890249251155226442",
                    "311504105775882186708492469294199040366"
                ]
            },
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/514b3297768f4a7469117a7005556663124040f9",
            "deprecated": false,
            "id": "ASB-A-152064592-0ef61e24"
        },
        {
            "target": {
                "function": "setView",
                "file": "core/java/android/view/ViewRootImpl.java"
            },
            "signature_version": "v1",
            "digest": {
                "function_hash": "83733493411385955548328862155120065153",
                "length": 7207.0
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/514b3297768f4a7469117a7005556663124040f9",
            "deprecated": false,
            "id": "ASB-A-152064592-238dff57"
        },
        {
            "target": {
                "file": "core/java/android/view/InputChannel.java"
            },
            "signature_version": "v1",
            "digest": {
                "line_hashes": [
                    "144314963066041979339326556589679816627",
                    "26796930622200074222979280170233243811",
                    "63210466038713291057509881786749335701"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/514b3297768f4a7469117a7005556663124040f9",
            "deprecated": false,
            "id": "ASB-A-152064592-97449418"
        },
        {
            "target": {
                "function": "addWindow",
                "file": "services/core/java/com/android/server/wm/WindowManagerService.java"
            },
            "digest": {
                "function_hash": "94006466396770710472872429492784209001",
                "length": 11965.0
            },
            "id": "ASB-A-152064592-98f727e2",
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/514b3297768f4a7469117a7005556663124040f9",
            "deprecated": false,
            "signature_version": "v1"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-152064592.json"