ASB-A-176444154

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-176444154.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-176444154
Aliases
Published
2021-06-01T00:00:00Z
Modified
2026-04-17T15:55:28.020024Z
Summary
[none]
Details

In various functions of DrmPlugin.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/frameworks/av

Package

Name
platform/frameworks/av

Affected ranges

Type
ECOSYSTEM
Events
Introduced
8.1:0
Fixed
8.1:2021-06-01

Affected versions

8.*
8.1

Ecosystem specific 

{
    "severity": "High",
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/av/+/db90c38bdc335869118f9168b167776054d7a290"
    ],
    "spl": "2021-06-01",
    "vanir_signatures": [
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/db90c38bdc335869118f9168b167776054d7a290",
            "target": {
                "function": "DrmPlugin::queryKeyStatus",
                "file": "drm/mediadrm/plugins/clearkey/DrmPlugin.cpp"
            },
            "deprecated": false,
            "digest": {
                "function_hash": "53845406188586660254644147917993154858",
                "length": 333.0
            },
            "signature_type": "Function",
            "id": "ASB-A-176444154-22fb6e61"
        },
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/db90c38bdc335869118f9168b167776054d7a290",
            "target": {
                "file": "drm/mediadrm/plugins/clearkey/DrmPlugin.h"
            },
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "116293419689235957797644142832982338869",
                    "91536267112923248737395670641316584525",
                    "84923215158781107856621438053361978491",
                    "155740318558482459469259593002638021043"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line",
            "id": "ASB-A-176444154-3ac27b42"
        },
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/db90c38bdc335869118f9168b167776054d7a290",
            "target": {
                "file": "drm/mediadrm/plugins/clearkey/DrmPlugin.cpp"
            },
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "168462199271924138225658459456356427237",
                    "30795897165636084177713910970499206703",
                    "320740076108162832979653989589412533713",
                    "339314856917899949697105459553639243218"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line",
            "id": "ASB-A-176444154-d853cf9a"
        }
    ],
    "types": [
        "EoP"
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-176444154.json"

Android / platform/frameworks/av

Package

Name
platform/frameworks/av

Affected ranges

Type
ECOSYSTEM
Events
Introduced
9:0
Fixed
9:2021-06-01

Affected versions

Other
9

Ecosystem specific 

{
    "severity": "High",
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/av/+/e11a4819f04229ac0c7a73585fcbe6a32c4c3524"
    ],
    "spl": "2021-06-01",
    "vanir_signatures": [
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/e11a4819f04229ac0c7a73585fcbe6a32c4c3524",
            "target": {
                "file": "drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp"
            },
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "12825988136066634236985574667124967073",
                    "45205286893824864093645941006601319655",
                    "263296191186424067700721010834316465565",
                    "6416743696019705549291756244586124879",
                    "86593308180303407231167108696424521961",
                    "282689817409416084412172127054367276921",
                    "207213833987636123216926910527826816219",
                    "14629586550660593902195539771028495630",
                    "10935137506986203545078647555040087146",
                    "99300207738115494283750265657524616244",
                    "333080766347881722157253125392002926826",
                    "166004908089751336578986899325934592326"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line",
            "id": "ASB-A-176444154-3baaed5c"
        },
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/e11a4819f04229ac0c7a73585fcbe6a32c4c3524",
            "target": {
                "file": "drm/mediadrm/plugins/clearkey/default/include/DrmPlugin.h"
            },
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "944410713029243776117556749120094087",
                    "281147500555576871898109810377836171496",
                    "329438668600229624618923935320806429205",
                    "251043956328504421949994284052717464266"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line",
            "id": "ASB-A-176444154-a6db811f"
        },
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/e11a4819f04229ac0c7a73585fcbe6a32c4c3524",
            "target": {
                "file": "drm/mediadrm/plugins/clearkey/default/DrmPlugin.cpp"
            },
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "168462199271924138225658459456356427237",
                    "30795897165636084177713910970499206703",
                    "320740076108162832979653989589412533713",
                    "339314856917899949697105459553639243218"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line",
            "id": "ASB-A-176444154-c3e5e1dd"
        },
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/e11a4819f04229ac0c7a73585fcbe6a32c4c3524",
            "target": {
                "function": "DrmPlugin::queryKeyStatus",
                "file": "drm/mediadrm/plugins/clearkey/default/DrmPlugin.cpp"
            },
            "deprecated": false,
            "digest": {
                "function_hash": "53845406188586660254644147917993154858",
                "length": 333.0
            },
            "signature_type": "Function",
            "id": "ASB-A-176444154-d5de6bd9"
        },
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/e11a4819f04229ac0c7a73585fcbe6a32c4c3524",
            "target": {
                "function": "DrmPlugin::queryKeyStatus",
                "file": "drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp"
            },
            "deprecated": false,
            "digest": {
                "function_hash": "263621837982489107459561715251884086246",
                "length": 480.0
            },
            "signature_type": "Function",
            "id": "ASB-A-176444154-f0a52a41"
        }
    ],
    "types": [
        "EoP"
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-176444154.json"

Android / platform/frameworks/av

Package

Name
platform/frameworks/av

Affected ranges

Type
ECOSYSTEM
Events
Introduced
10:0
Fixed
10:2021-06-01

Affected versions

Other
10

Ecosystem specific 

{
    "severity": "High",
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/av/+/3c73391f6e8c4d28f4ed3d1fc7379acdebaa6fa6"
    ],
    "spl": "2021-06-01",
    "vanir_signatures": [
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/3c73391f6e8c4d28f4ed3d1fc7379acdebaa6fa6",
            "target": {
                "file": "drm/mediadrm/plugins/clearkey/default/DrmPlugin.cpp"
            },
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "168462199271924138225658459456356427237",
                    "30795897165636084177713910970499206703",
                    "320740076108162832979653989589412533713",
                    "339314856917899949697105459553639243218"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line",
            "id": "ASB-A-176444154-31760a17"
        },
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/3c73391f6e8c4d28f4ed3d1fc7379acdebaa6fa6",
            "target": {
                "file": "drm/mediadrm/plugins/clearkey/default/include/DrmPlugin.h"
            },
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "944410713029243776117556749120094087",
                    "281147500555576871898109810377836171496",
                    "329438668600229624618923935320806429205",
                    "251043956328504421949994284052717464266"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line",
            "id": "ASB-A-176444154-88d98588"
        },
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/3c73391f6e8c4d28f4ed3d1fc7379acdebaa6fa6",
            "target": {
                "function": "DrmPlugin::queryKeyStatus",
                "file": "drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp"
            },
            "deprecated": false,
            "digest": {
                "function_hash": "263621837982489107459561715251884086246",
                "length": 480.0
            },
            "signature_type": "Function",
            "id": "ASB-A-176444154-96cdc29a"
        },
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/3c73391f6e8c4d28f4ed3d1fc7379acdebaa6fa6",
            "target": {
                "file": "drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp"
            },
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "12825988136066634236985574667124967073",
                    "45205286893824864093645941006601319655",
                    "263296191186424067700721010834316465565",
                    "6416743696019705549291756244586124879",
                    "86593308180303407231167108696424521961",
                    "282689817409416084412172127054367276921",
                    "207213833987636123216926910527826816219",
                    "14629586550660593902195539771028495630",
                    "10935137506986203545078647555040087146",
                    "99300207738115494283750265657524616244",
                    "333080766347881722157253125392002926826",
                    "166004908089751336578986899325934592326"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line",
            "id": "ASB-A-176444154-db4bdd6f"
        },
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/3c73391f6e8c4d28f4ed3d1fc7379acdebaa6fa6",
            "target": {
                "function": "DrmPlugin::queryKeyStatus",
                "file": "drm/mediadrm/plugins/clearkey/default/DrmPlugin.cpp"
            },
            "deprecated": false,
            "digest": {
                "function_hash": "53845406188586660254644147917993154858",
                "length": 333.0
            },
            "signature_type": "Function",
            "id": "ASB-A-176444154-fb13b777"
        }
    ],
    "types": [
        "EoP"
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-176444154.json"

Android / platform/frameworks/av

Package

Name
platform/frameworks/av

Affected ranges

Type
ECOSYSTEM
Events
Introduced
11:0
Fixed
11:2021-06-01

Affected versions

Other
11

Ecosystem specific 

{
    "severity": "High",
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/av/+/e07417a9b7829cfb32505947f700fd8dad9e12e6"
    ],
    "spl": "2021-06-01",
    "vanir_signatures": [
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/e07417a9b7829cfb32505947f700fd8dad9e12e6",
            "target": {
                "file": "drm/mediadrm/plugins/clearkey/default/DrmPlugin.cpp"
            },
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "168462199271924138225658459456356427237",
                    "30795897165636084177713910970499206703",
                    "320740076108162832979653989589412533713",
                    "339314856917899949697105459553639243218"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line",
            "id": "ASB-A-176444154-1e59ed40"
        },
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/e07417a9b7829cfb32505947f700fd8dad9e12e6",
            "target": {
                "file": "drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp"
            },
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "12825988136066634236985574667124967073",
                    "45205286893824864093645941006601319655",
                    "263296191186424067700721010834316465565",
                    "6416743696019705549291756244586124879",
                    "86593308180303407231167108696424521961",
                    "282689817409416084412172127054367276921",
                    "207213833987636123216926910527826816219",
                    "14629586550660593902195539771028495630",
                    "10935137506986203545078647555040087146",
                    "99300207738115494283750265657524616244",
                    "333080766347881722157253125392002926826",
                    "166004908089751336578986899325934592326"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line",
            "id": "ASB-A-176444154-2b32e8bc"
        },
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/e07417a9b7829cfb32505947f700fd8dad9e12e6",
            "target": {
                "function": "DrmPlugin::queryKeyStatus",
                "file": "drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp"
            },
            "deprecated": false,
            "digest": {
                "function_hash": "263621837982489107459561715251884086246",
                "length": 480.0
            },
            "signature_type": "Function",
            "id": "ASB-A-176444154-c7c3b502"
        },
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/e07417a9b7829cfb32505947f700fd8dad9e12e6",
            "target": {
                "function": "DrmPlugin::queryKeyStatus",
                "file": "drm/mediadrm/plugins/clearkey/default/DrmPlugin.cpp"
            },
            "deprecated": false,
            "digest": {
                "function_hash": "53845406188586660254644147917993154858",
                "length": 333.0
            },
            "signature_type": "Function",
            "id": "ASB-A-176444154-ecd79a0d"
        },
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/e07417a9b7829cfb32505947f700fd8dad9e12e6",
            "target": {
                "file": "drm/mediadrm/plugins/clearkey/default/include/DrmPlugin.h"
            },
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "944410713029243776117556749120094087",
                    "281147500555576871898109810377836171496",
                    "329438668600229624618923935320806429205",
                    "251043956328504421949994284052717464266"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line",
            "id": "ASB-A-176444154-f3942319"
        }
    ],
    "types": [
        "EoP"
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-176444154.json"