ASB-A-179839665

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-179839665.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-179839665
Aliases
Published
2021-09-01T00:00:00Z
Modified
2026-04-17T15:55:28.020024Z
Summary
[none]
Details

In TouchInputMapper::sync of TouchInputMapper.cpp, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/frameworks/native

Package

Name
platform/frameworks/native

Affected ranges

Type
ECOSYSTEM
Events
Introduced
8.1:0
Fixed
8.1:2021-09-01

Affected versions

8.*
8.1

Ecosystem specific

{
    "vanir_signatures": [
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "37453471462408686094850282967217977416",
                    "270187484785748654731955850859942230567",
                    "192316713145734928722127838181096616821",
                    "74126827077068516243974594962935301901"
                ]
            },
            "id": "ASB-A-179839665-2b5e5bfb",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/frameworks/native/+/ade0672333565773645abe89eccc468572c07228",
            "target": {
                "file": "services/inputflinger/InputReader.h"
            }
        },
        {
            "digest": {
                "length": 4041.0,
                "function_hash": "26441390556967683605450767544755284036"
            },
            "id": "ASB-A-179839665-5c0bb4b7",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/native/+/ade0672333565773645abe89eccc468572c07228",
            "target": {
                "function": "TouchInputMapper::assignPointerIds",
                "file": "services/inputflinger/InputReader.cpp"
            }
        },
        {
            "digest": {
                "length": 1115.0,
                "function_hash": "210470899102404797474366699497291592512"
            },
            "id": "ASB-A-179839665-80a72a9a",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/native/+/ade0672333565773645abe89eccc468572c07228",
            "target": {
                "function": "TouchInputMapper::sync",
                "file": "services/inputflinger/InputReader.cpp"
            }
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "140643837928628209673573375492340963356",
                    "296983044906620798494120806202603568140",
                    "203037264758895446548629013835459589356",
                    "165149599217966300726478325849205436423",
                    "318977918280431803532690310778364438652",
                    "206285575700257427579470810031331572275",
                    "267545748434222914387392651717038022213",
                    "50562833298505826315429433852085196309",
                    "185021482523196094289229054647668139803",
                    "94924369466567264828922178443483997629",
                    "291840531411921232147201429481383218246",
                    "36525787437167887703021825375168302668",
                    "16518900792103496046245475937223352544",
                    "63782867098257504310039093379668891864",
                    "66188051465004491780637135133886828926",
                    "125622338799064082109804821779617990332",
                    "168483301820792511639232925546204069313",
                    "144366005460061164989887734835014734437",
                    "208241707527069323221178065573368299502",
                    "162827399227369373053858401167197505778",
                    "85784337697641226212682558614633393472",
                    "249958429779156009063268395118172895742",
                    "239021837618226346442350415229040182131",
                    "242422034581613374118626160177313911816",
                    "74427060116077380053685158409984492626",
                    "272265513762207871596034780199447156567",
                    "198270760957223187232340386376390182663",
                    "313678621018294063274987508478509158255",
                    "172171621286474484653553954080891858498",
                    "271321110046680157435085023146144114179",
                    "249499598351866421542293802279866017930",
                    "209420261296387818232243586119044312049",
                    "291685069025790728687174477459734158628",
                    "149077202909194244688165243510707549087",
                    "220830054010147078418202837158138799699",
                    "336863639048950303212136240440961840898",
                    "110162774519345063988622624221413184449",
                    "211401561918479049303112828718067811550",
                    "235856174751960840729781675533188635754",
                    "172681276032402480950294554633862735072",
                    "155827019522860189898352432242140102162",
                    "22741435070087111952245796465277784909",
                    "154634327493376454094583669915075824266",
                    "175423335272657115157328977388527868636",
                    "63016536242080060548625588371671041906",
                    "52546109095377026088348078937276597818",
                    "110924117310725719298194768964532875013",
                    "1985021388010178043559187649001641018",
                    "59595671047942127212676848350336105541",
                    "126308464450753056157597702011082708435",
                    "163814413750266509075308024981230282550",
                    "88583345744287430870390301145448369840",
                    "92163064094201299374315360926219085427",
                    "24121345756459837129335070635648544636",
                    "333410759938769107983993456862193638886",
                    "269825266806564802631727901474632401701",
                    "62836141844012902594199506110711687759",
                    "189106438882919679409672200945227302023",
                    "52394304828616657892773509994369774073",
                    "181341768539332933215206481187739626834",
                    "158814092822834541596085868212655368777",
                    "67543565722585422302967730740754042077",
                    "338519794247264037234912154526378991342",
                    "142999074789789711869061024133550342884",
                    "189106438882919679409672200945227302023",
                    "80019505976851895306005292949861712602",
                    "302477980538100666982131615290562595522",
                    "38219713494086299132365563548828987419"
                ]
            },
            "id": "ASB-A-179839665-b84edbd2",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/frameworks/native/+/ade0672333565773645abe89eccc468572c07228",
            "target": {
                "file": "services/inputflinger/InputReader.cpp"
            }
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/native/+/ade0672333565773645abe89eccc468572c07228"
    ],
    "types": [
        "EoP"
    ],
    "spl": "2021-09-01",
    "severity": "High"
}

Database specific

source
"https://storage.googleapis.com/android-osv/ASB-A-179839665.json"
platform/frameworks/native

Package

Name
platform/frameworks/native

Affected ranges

Type
ECOSYSTEM
Events
Introduced
9:0
Fixed
9:2021-09-01

Affected versions

Other
9

Ecosystem specific

{
    "vanir_signatures": [
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "37453471462408686094850282967217977416",
                    "270187484785748654731955850859942230567",
                    "192316713145734928722127838181096616821",
                    "74126827077068516243974594962935301901"
                ]
            },
            "id": "ASB-A-179839665-03fc18bc",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/frameworks/native/+/ade0672333565773645abe89eccc468572c07228",
            "target": {
                "file": "services/inputflinger/InputReader.h"
            }
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "140643837928628209673573375492340963356",
                    "296983044906620798494120806202603568140",
                    "203037264758895446548629013835459589356",
                    "165149599217966300726478325849205436423",
                    "318977918280431803532690310778364438652",
                    "206285575700257427579470810031331572275",
                    "267545748434222914387392651717038022213",
                    "50562833298505826315429433852085196309",
                    "185021482523196094289229054647668139803",
                    "94924369466567264828922178443483997629",
                    "291840531411921232147201429481383218246",
                    "36525787437167887703021825375168302668",
                    "16518900792103496046245475937223352544",
                    "63782867098257504310039093379668891864",
                    "66188051465004491780637135133886828926",
                    "125622338799064082109804821779617990332",
                    "168483301820792511639232925546204069313",
                    "144366005460061164989887734835014734437",
                    "208241707527069323221178065573368299502",
                    "162827399227369373053858401167197505778",
                    "85784337697641226212682558614633393472",
                    "249958429779156009063268395118172895742",
                    "239021837618226346442350415229040182131",
                    "242422034581613374118626160177313911816",
                    "74427060116077380053685158409984492626",
                    "272265513762207871596034780199447156567",
                    "198270760957223187232340386376390182663",
                    "313678621018294063274987508478509158255",
                    "172171621286474484653553954080891858498",
                    "271321110046680157435085023146144114179",
                    "249499598351866421542293802279866017930",
                    "209420261296387818232243586119044312049",
                    "291685069025790728687174477459734158628",
                    "149077202909194244688165243510707549087",
                    "220830054010147078418202837158138799699",
                    "336863639048950303212136240440961840898",
                    "110162774519345063988622624221413184449",
                    "211401561918479049303112828718067811550",
                    "235856174751960840729781675533188635754",
                    "172681276032402480950294554633862735072",
                    "155827019522860189898352432242140102162",
                    "22741435070087111952245796465277784909",
                    "154634327493376454094583669915075824266",
                    "175423335272657115157328977388527868636",
                    "63016536242080060548625588371671041906",
                    "52546109095377026088348078937276597818",
                    "110924117310725719298194768964532875013",
                    "1985021388010178043559187649001641018",
                    "59595671047942127212676848350336105541",
                    "126308464450753056157597702011082708435",
                    "163814413750266509075308024981230282550",
                    "88583345744287430870390301145448369840",
                    "92163064094201299374315360926219085427",
                    "24121345756459837129335070635648544636",
                    "333410759938769107983993456862193638886",
                    "269825266806564802631727901474632401701",
                    "62836141844012902594199506110711687759",
                    "189106438882919679409672200945227302023",
                    "52394304828616657892773509994369774073",
                    "181341768539332933215206481187739626834",
                    "158814092822834541596085868212655368777",
                    "67543565722585422302967730740754042077",
                    "338519794247264037234912154526378991342",
                    "142999074789789711869061024133550342884",
                    "189106438882919679409672200945227302023",
                    "80019505976851895306005292949861712602",
                    "302477980538100666982131615290562595522",
                    "38219713494086299132365563548828987419"
                ]
            },
            "id": "ASB-A-179839665-0afd0174",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/frameworks/native/+/ade0672333565773645abe89eccc468572c07228",
            "target": {
                "file": "services/inputflinger/InputReader.cpp"
            }
        },
        {
            "digest": {
                "length": 1115.0,
                "function_hash": "210470899102404797474366699497291592512"
            },
            "id": "ASB-A-179839665-6354e865",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/native/+/ade0672333565773645abe89eccc468572c07228",
            "target": {
                "function": "TouchInputMapper::sync",
                "file": "services/inputflinger/InputReader.cpp"
            }
        },
        {
            "digest": {
                "length": 4041.0,
                "function_hash": "26441390556967683605450767544755284036"
            },
            "id": "ASB-A-179839665-ccaba7a1",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/native/+/ade0672333565773645abe89eccc468572c07228",
            "target": {
                "function": "TouchInputMapper::assignPointerIds",
                "file": "services/inputflinger/InputReader.cpp"
            }
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/native/+/ade0672333565773645abe89eccc468572c07228"
    ],
    "types": [
        "EoP"
    ],
    "spl": "2021-09-01",
    "severity": "High"
}

Database specific

source
"https://storage.googleapis.com/android-osv/ASB-A-179839665.json"
platform/frameworks/native

Package

Name
platform/frameworks/native

Affected ranges

Type
ECOSYSTEM
Events
Introduced
10:0
Fixed
10:2021-09-01

Affected versions

Other
10

Ecosystem specific

{
    "vanir_signatures": [
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "241884886795613663305700001657059519341",
                    "199865895155796170188889858879377642818",
                    "90248358151693939340768047114819707537",
                    "92917675672739599477443057448150144628",
                    "301489649842923470789755644856325046311",
                    "165197513480219925318191074139139639806",
                    "8039462894160351375512447839275483751",
                    "50562833298505826315429433852085196309",
                    "185021482523196094289229054647668139803",
                    "94924369466567264828922178443483997629",
                    "291840531411921232147201429481383218246",
                    "36525787437167887703021825375168302668",
                    "16518900792103496046245475937223352544",
                    "63782867098257504310039093379668891864",
                    "66188051465004491780637135133886828926",
                    "125622338799064082109804821779617990332",
                    "168483301820792511639232925546204069313",
                    "144366005460061164989887734835014734437",
                    "208241707527069323221178065573368299502",
                    "162827399227369373053858401167197505778",
                    "85784337697641226212682558614633393472",
                    "249958429779156009063268395118172895742",
                    "239021837618226346442350415229040182131",
                    "242422034581613374118626160177313911816",
                    "31920734387201257416760189945284937397",
                    "199928794576059375444304924414845105177",
                    "198270760957223187232340386376390182663",
                    "313678621018294063274987508478509158255",
                    "172171621286474484653553954080891858498",
                    "271321110046680157435085023146144114179",
                    "249499598351866421542293802279866017930",
                    "209420261296387818232243586119044312049",
                    "291685069025790728687174477459734158628",
                    "149077202909194244688165243510707549087",
                    "220830054010147078418202837158138799699",
                    "336863639048950303212136240440961840898",
                    "110162774519345063988622624221413184449",
                    "211401561918479049303112828718067811550",
                    "235856174751960840729781675533188635754",
                    "172681276032402480950294554633862735072",
                    "155827019522860189898352432242140102162",
                    "22741435070087111952245796465277784909",
                    "154634327493376454094583669915075824266",
                    "175423335272657115157328977388527868636",
                    "63016536242080060548625588371671041906",
                    "52546109095377026088348078937276597818",
                    "110924117310725719298194768964532875013",
                    "1985021388010178043559187649001641018",
                    "59595671047942127212676848350336105541",
                    "126308464450753056157597702011082708435",
                    "163814413750266509075308024981230282550",
                    "88583345744287430870390301145448369840",
                    "92163064094201299374315360926219085427",
                    "24121345756459837129335070635648544636",
                    "333410759938769107983993456862193638886",
                    "269825266806564802631727901474632401701",
                    "62836141844012902594199506110711687759",
                    "189106438882919679409672200945227302023",
                    "52394304828616657892773509994369774073",
                    "181341768539332933215206481187739626834",
                    "267955277502924505218919998371446349795",
                    "67543565722585422302967730740754042077",
                    "338519794247264037234912154526378991342",
                    "142999074789789711869061024133550342884",
                    "189106438882919679409672200945227302023",
                    "80019505976851895306005292949861712602",
                    "40962265475287505356642477138095983592",
                    "190783728334172625006212656508162630392"
                ]
            },
            "id": "ASB-A-179839665-23c7ad93",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/frameworks/native/+/beb878bcfb6c7e0cf0954934a0d364a4298eb840",
            "target": {
                "file": "services/inputflinger/InputReader.cpp"
            }
        },
        {
            "digest": {
                "length": 1119.0,
                "function_hash": "297442955698477237370350850625168568854"
            },
            "id": "ASB-A-179839665-439dfb2d",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/native/+/beb878bcfb6c7e0cf0954934a0d364a4298eb840",
            "target": {
                "function": "TouchInputMapper::sync",
                "file": "services/inputflinger/InputReader.cpp"
            }
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "37453471462408686094850282967217977416",
                    "68496236182815934752568072472082797789",
                    "204138266688367217935538668821724754917",
                    "126518086683465570927371789320191969610"
                ]
            },
            "id": "ASB-A-179839665-7294dc8a",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/frameworks/native/+/beb878bcfb6c7e0cf0954934a0d364a4298eb840",
            "target": {
                "file": "services/inputflinger/InputReader.h"
            }
        },
        {
            "digest": {
                "length": 4153.0,
                "function_hash": "288904787576248950631480096017069721113"
            },
            "id": "ASB-A-179839665-cd52379a",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/native/+/beb878bcfb6c7e0cf0954934a0d364a4298eb840",
            "target": {
                "function": "TouchInputMapper::assignPointerIds",
                "file": "services/inputflinger/InputReader.cpp"
            }
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/native/+/beb878bcfb6c7e0cf0954934a0d364a4298eb840"
    ],
    "types": [
        "EoP"
    ],
    "spl": "2021-09-01",
    "severity": "High"
}

Database specific

source
"https://storage.googleapis.com/android-osv/ASB-A-179839665.json"
platform/frameworks/native

Package

Name
platform/frameworks/native

Affected ranges

Type
ECOSYSTEM
Events
Introduced
11:0
Fixed
11:2021-09-01

Affected versions

Other
11

Ecosystem specific

{
    "vanir_signatures": [
        {
            "digest": {
                "length": 1117.0,
                "function_hash": "151043580982549880673561575266047370151"
            },
            "id": "ASB-A-179839665-c8323a7f",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/native/+/8cf78f9553981600f57e9c829886848172114484",
            "target": {
                "function": "TouchInputMapper::sync",
                "file": "services/inputflinger/reader/mapper/TouchInputMapper.cpp"
            }
        },
        {
            "digest": {
                "length": 4151.0,
                "function_hash": "289180077886405751010126479667114575204"
            },
            "id": "ASB-A-179839665-c96c7f7c",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/native/+/8cf78f9553981600f57e9c829886848172114484",
            "target": {
                "function": "TouchInputMapper::assignPointerIds",
                "file": "services/inputflinger/reader/mapper/TouchInputMapper.cpp"
            }
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "96127459265939697311380192836208065",
                    "270187484785748654731955850859942230567",
                    "124902081907597841969893592212060302914",
                    "28708297609219716142302362792826933651"
                ]
            },
            "id": "ASB-A-179839665-e73b2abe",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/frameworks/native/+/8cf78f9553981600f57e9c829886848172114484",
            "target": {
                "file": "services/inputflinger/reader/mapper/TouchInputMapper.h"
            }
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "215759629146814751277251112413623053815",
                    "199865895155796170188889858879377642818",
                    "90248358151693939340768047114819707537",
                    "92917675672739599477443057448150144628",
                    "92954060342116610109038763722624795424",
                    "165197513480219925318191074139139639806",
                    "137437090326306864895112160712398383162",
                    "50562833298505826315429433852085196309",
                    "185021482523196094289229054647668139803",
                    "94924369466567264828922178443483997629",
                    "52074068425549794749585625310628828557",
                    "36525787437167887703021825375168302668",
                    "16518900792103496046245475937223352544",
                    "63782867098257504310039093379668891864",
                    "66188051465004491780637135133886828926",
                    "210218597954968526638880423767599657094",
                    "219069451594436357465575802875667262739",
                    "185987381442343244165709524745136387998",
                    "188217260784989814055875201909611459615",
                    "112286783498416103224112308318896257262",
                    "74103088052703790147423980771816344698",
                    "31920734387201257416760189945284937397",
                    "199928794576059375444304924414845105177",
                    "198270760957223187232340386376390182663",
                    "313678621018294063274987508478509158255",
                    "172171621286474484653553954080891858498",
                    "271321110046680157435085023146144114179",
                    "249499598351866421542293802279866017930",
                    "209420261296387818232243586119044312049",
                    "291685069025790728687174477459734158628",
                    "149077202909194244688165243510707549087",
                    "220830054010147078418202837158138799699",
                    "336863639048950303212136240440961840898",
                    "110162774519345063988622624221413184449",
                    "233513115603663828987695129150341324936",
                    "193245114849292788454921978320821160898",
                    "20933880952911368353156748113428923987",
                    "337070324981819810322504995356371538736",
                    "72522980031743569239989601414835027065",
                    "175423335272657115157328977388527868636",
                    "63016536242080060548625588371671041906",
                    "52546109095377026088348078937276597818",
                    "110924117310725719298194768964532875013",
                    "1985021388010178043559187649001641018",
                    "59595671047942127212676848350336105541",
                    "126308464450753056157597702011082708435",
                    "163814413750266509075308024981230282550",
                    "88583345744287430870390301145448369840",
                    "92163064094201299374315360926219085427",
                    "24121345756459837129335070635648544636",
                    "333410759938769107983993456862193638886",
                    "269825266806564802631727901474632401701",
                    "62836141844012902594199506110711687759",
                    "147384213990732893568337655889185303097",
                    "66845174856083416162727945864807801823",
                    "56296797725611751610176291628005786923",
                    "141680074764531124471999971942052793017",
                    "290598740354888638485804339797201895067",
                    "67543565722585422302967730740754042077",
                    "338519794247264037234912154526378991342",
                    "142999074789789711869061024133550342884",
                    "189106438882919679409672200945227302023",
                    "80019505976851895306005292949861712602",
                    "40962265475287505356642477138095983592",
                    "190783728334172625006212656508162630392"
                ]
            },
            "id": "ASB-A-179839665-f05f8b63",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/frameworks/native/+/8cf78f9553981600f57e9c829886848172114484",
            "target": {
                "file": "services/inputflinger/reader/mapper/TouchInputMapper.cpp"
            }
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/native/+/8cf78f9553981600f57e9c829886848172114484"
    ],
    "types": [
        "EoP"
    ],
    "spl": "2021-09-01",
    "severity": "High"
}

Database specific

source
"https://storage.googleapis.com/android-osv/ASB-A-179839665.json"