ASB-A-173791720

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-173791720.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-173791720
Aliases
Published
2021-05-01T00:00:00Z
Modified
2026-04-17T15:55:28.020024Z
Summary
[none]
Details

In BinderDiedCallback of MediaCodec.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/frameworks/av

Package

Name
platform/frameworks/av

Affected ranges

Type
ECOSYSTEM
Events
Introduced
11:0
Fixed
11:2021-05-01

Affected versions

Other
11

Ecosystem specific 

{
    "severity": "High",
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/av/+/d11e1606e3183c97771ce46ea213a9d71223c45f"
    ],
    "spl": "2021-05-01",
    "vanir_signatures": [
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/d11e1606e3183c97771ce46ea213a9d71223c45f",
            "target": {
                "file": "media/libstagefright/MediaCodec.cpp"
            },
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "31720975925371240062096962052173993532",
                    "32890642582790990401923168691713557679",
                    "193205213437368109749021548128736062943",
                    "291095870346864351525038385758693296440",
                    "101800555834483060078922478256255672403",
                    "53857638293026492631586814022719749582",
                    "108077987798667861763436399720858649243",
                    "9680066337789697969397751176713189604",
                    "51735360889714806237317608628319082383",
                    "336371214607740558140805486650704358189",
                    "172887182482113472360488374289864876334",
                    "297970688711824588001664852039962223815",
                    "284971779020009294491005523693180868253",
                    "244532554672678047083455290050022905178",
                    "6835333318025838598805636986210187962",
                    "248919439583777541603689600075566970616",
                    "85973394935136365577603272088800369827",
                    "310434769550580136398104748284764588653",
                    "126387952158582908508781902712900972522",
                    "27576804663472073380290529978259404365"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line",
            "id": "ASB-A-173791720-279bf9a0"
        },
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/d11e1606e3183c97771ce46ea213a9d71223c45f",
            "target": {
                "function": "MediaCodec::ResourceManagerServiceProxy::init",
                "file": "media/libstagefright/MediaCodec.cpp"
            },
            "deprecated": false,
            "digest": {
                "function_hash": "62906351011521272114789696718489729566",
                "length": 358.0
            },
            "signature_type": "Function",
            "id": "ASB-A-173791720-51ad4a44"
        },
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/d11e1606e3183c97771ce46ea213a9d71223c45f",
            "target": {
                "function": "MediaCodec::ResourceManagerServiceProxy::~ResourceManagerServiceProxy",
                "file": "media/libstagefright/MediaCodec.cpp"
            },
            "deprecated": false,
            "digest": {
                "function_hash": "199634622738700981948097317946204406748",
                "length": 197.0
            },
            "signature_type": "Function",
            "id": "ASB-A-173791720-54988edb"
        },
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/d11e1606e3183c97771ce46ea213a9d71223c45f",
            "target": {
                "function": "MediaCodec::ResourceManagerServiceProxy::BinderDiedCallback",
                "file": "media/libstagefright/MediaCodec.cpp"
            },
            "deprecated": false,
            "digest": {
                "function_hash": "195702878043464915354362868006007168623",
                "length": 141.0
            },
            "signature_type": "Function",
            "id": "ASB-A-173791720-61024d0d"
        }
    ],
    "types": [
        "EoP"
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-173791720.json"