In phTmlNfcInit and phTmlNfcCleanUp of phTmlNfc.cc, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"types": [
"EoP"
],
"fixes": [
"https://android.googlesource.com/platform/hardware/nxp/nfc/+/cf72695ce1825007b8705338fd5baa583b50bd81"
],
"spl": "2022-01-01",
"vanir_signatures": [
{
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/cf72695ce1825007b8705338fd5baa583b50bd81",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-197353344-41c80c61",
"digest": {
"threshold": 0.9,
"line_hashes": [
"79977752736498591055745919943296483020",
"280191281260799491227299689449532060734",
"338573141868888499314709268095003018284",
"202975929060145663993056057647499796875"
]
},
"signature_type": "Line",
"target": {
"file": "halimpl/tml/phTmlNfc.cc"
}
}
],
"severity": "High"
}
{
"types": [
"EoP"
],
"fixes": [
"https://android.googlesource.com/platform/hardware/nxp/nfc/+/647f3fcc75511c6f05e1670d2457b0d93c13abdf"
],
"spl": "2022-01-01",
"vanir_signatures": [
{
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/647f3fcc75511c6f05e1670d2457b0d93c13abdf",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-197353344-c154712b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"79977752736498591055745919943296483020",
"280191281260799491227299689449532060734",
"338573141868888499314709268095003018284",
"202975929060145663993056057647499796875"
]
},
"signature_type": "Line",
"target": {
"file": "halimpl/tml/phTmlNfc.cc"
}
}
],
"severity": "High"
}
{
"types": [
"EoP"
],
"fixes": [
"https://android.googlesource.com/platform/hardware/nxp/nfc/+/647f3fcc75511c6f05e1670d2457b0d93c13abdf"
],
"spl": "2022-01-01",
"vanir_signatures": [
{
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/647f3fcc75511c6f05e1670d2457b0d93c13abdf",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-197353344-11ad9091",
"digest": {
"threshold": 0.9,
"line_hashes": [
"79977752736498591055745919943296483020",
"280191281260799491227299689449532060734",
"338573141868888499314709268095003018284",
"202975929060145663993056057647499796875"
]
},
"signature_type": "Line",
"target": {
"file": "halimpl/tml/phTmlNfc.cc"
}
}
],
"severity": "High"
}
{
"types": [
"EoP"
],
"fixes": [
"https://android.googlesource.com/platform/hardware/nxp/nfc/+/e777cc1902b4f063886035857ac9d396453ecb36"
],
"spl": "2022-01-01",
"vanir_signatures": [
{
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/e777cc1902b4f063886035857ac9d396453ecb36",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-197353344-16165492",
"digest": {
"threshold": 0.9,
"line_hashes": [
"79977752736498591055745919943296483020",
"280191281260799491227299689449532060734",
"338573141868888499314709268095003018284",
"202975929060145663993056057647499796875"
]
},
"signature_type": "Line",
"target": {
"file": "pn8x/halimpl/tml/phTmlNfc.cc"
}
}
],
"severity": "High"
}