In phTmlNfcInit and phTmlNfcCleanUp of phTmlNfc.cc, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "79977752736498591055745919943296483020", "280191281260799491227299689449532060734", "338573141868888499314709268095003018284", "202975929060145663993056057647499796875" ] }, "signature_version": "v1", "deprecated": false, "source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/cf72695ce1825007b8705338fd5baa583b50bd81", "target": { "file": "halimpl/tml/phTmlNfc.cc" }, "id": "ASB-A-197353344-41c80c61", "signature_type": "Line" } ], "severity": "High", "types": [ "EoP" ], "fixes": [ "https://android.googlesource.com/platform/hardware/nxp/nfc/+/cf72695ce1825007b8705338fd5baa583b50bd81" ], "spl": "2022-01-01" }
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "79977752736498591055745919943296483020", "280191281260799491227299689449532060734", "338573141868888499314709268095003018284", "202975929060145663993056057647499796875" ] }, "signature_version": "v1", "deprecated": false, "source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/647f3fcc75511c6f05e1670d2457b0d93c13abdf", "target": { "file": "halimpl/tml/phTmlNfc.cc" }, "id": "ASB-A-197353344-c154712b", "signature_type": "Line" } ], "severity": "High", "types": [ "EoP" ], "fixes": [ "https://android.googlesource.com/platform/hardware/nxp/nfc/+/647f3fcc75511c6f05e1670d2457b0d93c13abdf" ], "spl": "2022-01-01" }
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "79977752736498591055745919943296483020", "280191281260799491227299689449532060734", "338573141868888499314709268095003018284", "202975929060145663993056057647499796875" ] }, "signature_version": "v1", "deprecated": false, "source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/647f3fcc75511c6f05e1670d2457b0d93c13abdf", "target": { "file": "halimpl/tml/phTmlNfc.cc" }, "id": "ASB-A-197353344-11ad9091", "signature_type": "Line" } ], "severity": "High", "types": [ "EoP" ], "fixes": [ "https://android.googlesource.com/platform/hardware/nxp/nfc/+/647f3fcc75511c6f05e1670d2457b0d93c13abdf" ], "spl": "2022-01-01" }
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "79977752736498591055745919943296483020", "280191281260799491227299689449532060734", "338573141868888499314709268095003018284", "202975929060145663993056057647499796875" ] }, "signature_version": "v1", "deprecated": false, "source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/e777cc1902b4f063886035857ac9d396453ecb36", "target": { "file": "pn8x/halimpl/tml/phTmlNfc.cc" }, "id": "ASB-A-197353344-16165492", "signature_type": "Line" } ], "severity": "High", "types": [ "EoP" ], "fixes": [ "https://android.googlesource.com/platform/hardware/nxp/nfc/+/e777cc1902b4f063886035857ac9d396453ecb36" ], "spl": "2022-01-01" }