In multiple functions of looperbackedevent_loop.cpp, there is a possible way to corrupt memory due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"spl": "2023-02-01",
"fixes": [
"https://android.googlesource.com/platform/system/connectivity/wificond/+/a9de1657e9915a2d47fb87a3f55ac97157ad53b6"
],
"types": [
"EoP"
],
"vanir_signatures": [
{
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"319327535018563556537300619132357203352",
"17999300148438267301587355388994997822",
"306879720608399222000438574532273225381",
"108460143985267635697560081242897765717",
"47479131463942207073837147878800670514",
"91236466443986010974016562541256132573",
"40952505575044049327392086311685666435",
"183542082121842634020895745373219636274",
"72481930177212987020019770101385593031",
"307739422484241164954545676323133249978",
"93647322595107672473061259369585552911",
"237612482315895765008086015596871373212",
"187592753822623485824279067848869789625",
"270715323998066927257979354458094253841",
"121768234032291930514744645347766483640",
"147316941013154811716422241642034045900"
],
"threshold": 0.9
},
"source": "https://android.googlesource.com/platform/system/connectivity/wificond/+/a9de1657e9915a2d47fb87a3f55ac97157ad53b6",
"target": {
"file": "looper_backed_event_loop.cpp"
},
"id": "ASB-A-243362981-65513374"
}
],
"severity": "High"
}{
"spl": "2023-02-01",
"fixes": [
"https://android.googlesource.com/platform/system/connectivity/wificond/+/f43bf30eadb6c423e9748a69479fa146a196e8dc"
],
"types": [
"EoP"
],
"vanir_signatures": [
{
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"319327535018563556537300619132357203352",
"17999300148438267301587355388994997822",
"306879720608399222000438574532273225381",
"108460143985267635697560081242897765717",
"47479131463942207073837147878800670514",
"91236466443986010974016562541256132573",
"40952505575044049327392086311685666435",
"183542082121842634020895745373219636274",
"72481930177212987020019770101385593031",
"307739422484241164954545676323133249978",
"93647322595107672473061259369585552911",
"237612482315895765008086015596871373212",
"187592753822623485824279067848869789625",
"270715323998066927257979354458094253841",
"121768234032291930514744645347766483640",
"147316941013154811716422241642034045900"
],
"threshold": 0.9
},
"source": "https://android.googlesource.com/platform/system/connectivity/wificond/+/f43bf30eadb6c423e9748a69479fa146a196e8dc",
"target": {
"file": "looper_backed_event_loop.cpp"
},
"id": "ASB-A-243362981-a40d2f7d"
}
],
"severity": "High"
}{
"spl": "2023-02-01",
"fixes": [
"https://android.googlesource.com/platform/system/connectivity/wificond/+/73bb787e6e780a0dd15c0d3d03efaf5dfc270e26"
],
"types": [
"EoP"
],
"vanir_signatures": [
{
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"319327535018563556537300619132357203352",
"17999300148438267301587355388994997822",
"306879720608399222000438574532273225381",
"108460143985267635697560081242897765717",
"47479131463942207073837147878800670514",
"91236466443986010974016562541256132573",
"231687596611044883303053317069486143984",
"256345738579418720570831858151960272017",
"190379933020435969839673579103666204962",
"242524073966062844225675598012649427056",
"93647322595107672473061259369585552911",
"237612482315895765008086015596871373212",
"204399469402561494830585794807320834393",
"319444232589160658979659192150897816963",
"183696515813962808202524282340802979573",
"57237081120627105187066569127807783311"
],
"threshold": 0.9
},
"source": "https://android.googlesource.com/platform/system/connectivity/wificond/+/73bb787e6e780a0dd15c0d3d03efaf5dfc270e26",
"target": {
"file": "looper_backed_event_loop.cpp"
},
"id": "ASB-A-243362981-a5f8b24e"
}
],
"severity": "High"
}