In setUpdatableDriverPath of GpuService.cpp, there is a possible memory corruption due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"264256544272594088135784800754181967027",
"123321243359111629203240604431797151766",
"299461972247258878602252592219276638636",
"177537507348629395715785302902244641155",
"248769019103970512932940209630316618251",
"162548355003454448619806427536862326406",
"80286516831324134410496709583215525842"
]
},
"id": "ASB-A-162383705-68267dfd",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/native/+/e0984b06cb64acc83a54a60854ad03e65a3cea1e",
"deprecated": false,
"target": {
"file": "services/gpuservice/GpuService.cpp"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"151156310192421868206646112945686981946",
"120682369429687692599538525548468073902",
"129346926263402459773606233107877525480",
"218903388341399480723365307187486388248"
]
},
"id": "ASB-A-162383705-69577482",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/native/+/e0984b06cb64acc83a54a60854ad03e65a3cea1e",
"deprecated": false,
"target": {
"file": "services/gpuservice/GpuService.h"
},
"signature_version": "v1"
},
{
"digest": {
"function_hash": "245590056813529783278785775162785530303",
"length": 79.0
},
"id": "ASB-A-162383705-a1515927",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/native/+/e0984b06cb64acc83a54a60854ad03e65a3cea1e",
"deprecated": false,
"target": {
"function": "GpuService::getUpdatableDriverPath",
"file": "services/gpuservice/GpuService.cpp"
},
"signature_version": "v1"
},
{
"digest": {
"function_hash": "157993196880329670002802149241472168944",
"length": 100.0
},
"id": "ASB-A-162383705-f29d0813",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/native/+/e0984b06cb64acc83a54a60854ad03e65a3cea1e",
"deprecated": false,
"target": {
"function": "GpuService::setUpdatableDriverPath",
"file": "services/gpuservice/GpuService.cpp"
},
"signature_version": "v1"
}
],
"types": [
"EoP"
],
"spl": "2020-10-01",
"fixes": [
"https://android.googlesource.com/platform/frameworks/native/+/e0984b06cb64acc83a54a60854ad03e65a3cea1e"
],
"severity": "High"
}