In ip6mroutesetsockopt and related functions of ip6mr.c, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "298009621754784947338976317639313641580", "238898635758313853733269622164346830466", "164981494354328959081603277826549826038", "54730709383692090809855170929975497157", "100812824994221953414922115304082628324", "161321961574033993320537476681077070219", "307616960852696608536787177282000021506", "260955927640175033788372205548123349701", "3013348516959180471679634323967881011", "36801583908514757786675713252300506322", "238898635758313853733269622164346830466", "164981494354328959081603277826549826038" ] }, "id": "ASB-A-172999675-74456a17", "source": "https://android.googlesource.com/kernel/common/+/99253eb750fda6a644d5188fb26c43bad8d5a745", "deprecated": false, "signature_version": "v1", "target": { "file": "net/ipv6/ip6mr.c" }, "signature_type": "Line" }, { "digest": { "length": 2763.0, "function_hash": "334410933136282710967774068023981460530" }, "id": "ASB-A-172999675-e2fa80cf", "source": "https://android.googlesource.com/kernel/common/+/99253eb750fda6a644d5188fb26c43bad8d5a745", "deprecated": false, "signature_version": "v1", "target": { "file": "net/ipv6/ip6mr.c", "function": "ip6_mroute_setsockopt" }, "signature_type": "Function" }, { "digest": { "length": 772.0, "function_hash": "213724507498041325655797406518481755665" }, "id": "ASB-A-172999675-e920a872", "source": "https://android.googlesource.com/kernel/common/+/99253eb750fda6a644d5188fb26c43bad8d5a745", "deprecated": false, "signature_version": "v1", "target": { "file": "net/ipv6/ip6mr.c", "function": "ip6_mroute_getsockopt" }, "signature_type": "Function" } ], "fixes": [ "https://android.googlesource.com/kernel/common/+/99253eb750fda6a644d5188fb26c43bad8d5a745" ], "spl": "2021-02-05", "severity": "High", "types": [ "EoP" ] }