In usbsgcancel of message.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "255943705818962813189976031016472597529", "26033224937548943097948035650581242614", "526934606920560820297120827636957638", "31740174451050260298108892113833111941", "88334139816857127022371209949018334689", "83400255864374188643152245675839267384", "18976699313310297325405290768711954450", "295323004618949905759279342173215295091", "87686149460333506480774470036864217880", "243721719629647059646551031181529773032", "148076998368388731406663931420594976352", "152475867996944593949176481686230090508" ] }, "id": "ASB-A-156071259-7e12f48b", "source": "https://android.googlesource.com/kernel/common/+/056ad39ee925", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/core/message.c", "truncated_path_level": 1.0 }, "signature_type": "Line" }, { "digest": { "length": 555.0, "function_hash": "3645988281826647388253086379590913140" }, "id": "ASB-A-156071259-e647a430", "source": "https://android.googlesource.com/kernel/common/+/056ad39ee925", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/core/message.c", "truncated_path_level": 1.0, "function": "usb_sg_cancel" }, "signature_type": "Function" } ], "fixes": [ "https://android.googlesource.com/kernel/common/+/056ad39ee925" ], "spl": "2020-08-05", "severity": "High", "types": [ "EoP" ] }