ASB-A-461507723

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-461507723.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-461507723
Aliases
  • A-461507723
  • CVE-2026-58956
Published
2026-11-01T00:00:00Z
Modified
2026-11-02T17:11:17Z
Summary
[none]
Details

In modpowF4 of avb_rsa.c, there is a possible signature verification bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/external/avb

Package

Name
platform/external/avb

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-qpr2-next:0
Fixed
17-qpr2-next:2026-11-01

Affected versions

Other
17-qpr2-next

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/external/avb/+/5262c8ef81ae5d4606da24d004bd3170308f9dcf"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "295888276594966255304195588615565650312",
                    "43919443325846488345856449299617816396",
                    "47918743755306585630071247991389662160",
                    "90320165058021931767383223621283132405",
                    "25652301680987172828517213841730144170",
                    "186167342490246128988331065328875165621",
                    "145079804260352517559297267693476946183",
                    "270958262497982618998214295548258911279",
                    "222739456146484954029573998889475780352",
                    "334951624658366945285492077903980358926",
                    "37001477771028326292229767023349440890",
                    "340193210849633232090684683998124351142",
                    "80084644866510519480419027006621445508",
                    "102459536319354513070929098183781529195",
                    "289794736789759278524507271740860914604",
                    "57237917623675569214869953447193572993",
                    "221621757692718643360303840497824853455",
                    "179527262868024871688976240454254376896"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-461507723-005b0c6c",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/avb/+/5262c8ef81ae5d4606da24d004bd3170308f9dcf",
            "target":  {
                "file":  "libavb/avb_rsa.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "99121567533606075055862966666024805091",
                "length":  1360
            },
            "id":  "ASB-A-461507723-9d51b375",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/avb/+/5262c8ef81ae5d4606da24d004bd3170308f9dcf",
            "target":  {
                "file":  "libavb/avb_rsa.c",
                "function":  "modpowF4"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "69548868784106392191353185226868731472",
                "length":  1531
            },
            "id":  "ASB-A-461507723-b077173e",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/avb/+/5262c8ef81ae5d4606da24d004bd3170308f9dcf",
            "target":  {
                "file":  "libavb/avb_rsa.c",
                "function":  "avb_rsa_verify"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-461507723.json"
platform/external/avb

Package

Name
platform/external/avb

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-11-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/external/avb/+/e85551ac83e561a8ee0a14408acf8928f2afea7d"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "59930707550007530595320650224867079192",
                "length":  1197
            },
            "id":  "ASB-A-461507723-1636f1e7",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/avb/+/e85551ac83e561a8ee0a14408acf8928f2afea7d",
            "target":  {
                "file":  "libavb/avb_rsa.c",
                "function":  "avb_rsa_verify"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "99121567533606075055862966666024805091",
                "length":  1360
            },
            "id":  "ASB-A-461507723-c06135e8",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/avb/+/e85551ac83e561a8ee0a14408acf8928f2afea7d",
            "target":  {
                "file":  "libavb/avb_rsa.c",
                "function":  "modpowF4"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "295888276594966255304195588615565650312",
                    "43919443325846488345856449299617816396",
                    "47918743755306585630071247991389662160",
                    "90320165058021931767383223621283132405",
                    "25652301680987172828517213841730144170",
                    "186167342490246128988331065328875165621",
                    "145079804260352517559297267693476946183",
                    "270958262497982618998214295548258911279",
                    "222739456146484954029573998889475780352",
                    "334951624658366945285492077903980358926",
                    "37001477771028326292229767023349440890",
                    "340193210849633232090684683998124351142",
                    "237040744458659864527797877325660687507",
                    "253166598775633115102591107008784942957",
                    "289794736789759278524507271740860914604",
                    "57237917623675569214869953447193572993",
                    "221621757692718643360303840497824853455",
                    "179527262868024871688976240454254376896"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-461507723-eb0e7707",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/avb/+/e85551ac83e561a8ee0a14408acf8928f2afea7d",
            "target":  {
                "file":  "libavb/avb_rsa.c"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-461507723.json"
platform/external/avb

Package

Name
platform/external/avb

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-11-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/external/avb/+/09ae0f478a10d492a91f9355b47e57460d36bf88"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "59930707550007530595320650224867079192",
                "length":  1197
            },
            "id":  "ASB-A-461507723-95c44735",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/avb/+/09ae0f478a10d492a91f9355b47e57460d36bf88",
            "target":  {
                "file":  "libavb/avb_rsa.c",
                "function":  "avb_rsa_verify"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "99121567533606075055862966666024805091",
                "length":  1360
            },
            "id":  "ASB-A-461507723-b0086948",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/avb/+/09ae0f478a10d492a91f9355b47e57460d36bf88",
            "target":  {
                "file":  "libavb/avb_rsa.c",
                "function":  "modpowF4"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "295888276594966255304195588615565650312",
                    "43919443325846488345856449299617816396",
                    "47918743755306585630071247991389662160",
                    "90320165058021931767383223621283132405",
                    "25652301680987172828517213841730144170",
                    "186167342490246128988331065328875165621",
                    "145079804260352517559297267693476946183",
                    "270958262497982618998214295548258911279",
                    "222739456146484954029573998889475780352",
                    "334951624658366945285492077903980358926",
                    "37001477771028326292229767023349440890",
                    "340193210849633232090684683998124351142",
                    "237040744458659864527797877325660687507",
                    "253166598775633115102591107008784942957",
                    "289794736789759278524507271740860914604",
                    "57237917623675569214869953447193572993",
                    "221621757692718643360303840497824853455",
                    "179527262868024871688976240454254376896"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-461507723-ec514cf7",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/avb/+/09ae0f478a10d492a91f9355b47e57460d36bf88",
            "target":  {
                "file":  "libavb/avb_rsa.c"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-461507723.json"
platform/external/avb

Package

Name
platform/external/avb

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-11-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/external/avb/+/d2f20a12eabce52ebef18ed02ca44c4ac97a6a4c"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "69548868784106392191353185226868731472",
                "length":  1531
            },
            "id":  "ASB-A-461507723-60e3e5f8",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/avb/+/d2f20a12eabce52ebef18ed02ca44c4ac97a6a4c",
            "target":  {
                "file":  "libavb/avb_rsa.c",
                "function":  "avb_rsa_verify"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "295888276594966255304195588615565650312",
                    "43919443325846488345856449299617816396",
                    "47918743755306585630071247991389662160",
                    "90320165058021931767383223621283132405",
                    "25652301680987172828517213841730144170",
                    "186167342490246128988331065328875165621",
                    "145079804260352517559297267693476946183",
                    "270958262497982618998214295548258911279",
                    "222739456146484954029573998889475780352",
                    "334951624658366945285492077903980358926",
                    "37001477771028326292229767023349440890",
                    "340193210849633232090684683998124351142",
                    "80084644866510519480419027006621445508",
                    "102459536319354513070929098183781529195",
                    "289794736789759278524507271740860914604",
                    "57237917623675569214869953447193572993",
                    "221621757692718643360303840497824853455",
                    "179527262868024871688976240454254376896"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-461507723-7b487072",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/avb/+/d2f20a12eabce52ebef18ed02ca44c4ac97a6a4c",
            "target":  {
                "file":  "libavb/avb_rsa.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "99121567533606075055862966666024805091",
                "length":  1360
            },
            "id":  "ASB-A-461507723-af506b73",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/avb/+/d2f20a12eabce52ebef18ed02ca44c4ac97a6a4c",
            "target":  {
                "file":  "libavb/avb_rsa.c",
                "function":  "modpowF4"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-461507723.json"
platform/external/avb

Package

Name
platform/external/avb

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-11-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/external/avb/+/88d897a6a52b484d190bd6bb6b01d9d8678b3b11"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "295888276594966255304195588615565650312",
                    "43919443325846488345856449299617816396",
                    "47918743755306585630071247991389662160",
                    "90320165058021931767383223621283132405",
                    "25652301680987172828517213841730144170",
                    "186167342490246128988331065328875165621",
                    "145079804260352517559297267693476946183",
                    "270958262497982618998214295548258911279",
                    "222739456146484954029573998889475780352",
                    "334951624658366945285492077903980358926",
                    "37001477771028326292229767023349440890",
                    "340193210849633232090684683998124351142",
                    "80084644866510519480419027006621445508",
                    "102459536319354513070929098183781529195",
                    "289794736789759278524507271740860914604",
                    "57237917623675569214869953447193572993",
                    "221621757692718643360303840497824853455",
                    "179527262868024871688976240454254376896"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-461507723-1e309872",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/avb/+/88d897a6a52b484d190bd6bb6b01d9d8678b3b11",
            "target":  {
                "file":  "libavb/avb_rsa.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "99121567533606075055862966666024805091",
                "length":  1360
            },
            "id":  "ASB-A-461507723-b5b03191",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/avb/+/88d897a6a52b484d190bd6bb6b01d9d8678b3b11",
            "target":  {
                "file":  "libavb/avb_rsa.c",
                "function":  "modpowF4"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "69548868784106392191353185226868731472",
                "length":  1531
            },
            "id":  "ASB-A-461507723-c85f16a6",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/avb/+/88d897a6a52b484d190bd6bb6b01d9d8678b3b11",
            "target":  {
                "file":  "libavb/avb_rsa.c",
                "function":  "avb_rsa_verify"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-461507723.json"
platform/external/avb

Package

Name
platform/external/avb

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-11-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/external/avb/+/e8819556a9d3da7cb46005e9bbed970da4777455"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "295888276594966255304195588615565650312",
                    "43919443325846488345856449299617816396",
                    "47918743755306585630071247991389662160",
                    "90320165058021931767383223621283132405",
                    "25652301680987172828517213841730144170",
                    "186167342490246128988331065328875165621",
                    "145079804260352517559297267693476946183",
                    "270958262497982618998214295548258911279",
                    "222739456146484954029573998889475780352",
                    "334951624658366945285492077903980358926",
                    "37001477771028326292229767023349440890",
                    "340193210849633232090684683998124351142",
                    "237040744458659864527797877325660687507",
                    "253166598775633115102591107008784942957",
                    "289794736789759278524507271740860914604",
                    "57237917623675569214869953447193572993",
                    "221621757692718643360303840497824853455",
                    "179527262868024871688976240454254376896"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-461507723-38159e5a",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/avb/+/e8819556a9d3da7cb46005e9bbed970da4777455",
            "target":  {
                "file":  "libavb/avb_rsa.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "59930707550007530595320650224867079192",
                "length":  1197
            },
            "id":  "ASB-A-461507723-8e70628d",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/avb/+/e8819556a9d3da7cb46005e9bbed970da4777455",
            "target":  {
                "file":  "libavb/avb_rsa.c",
                "function":  "avb_rsa_verify"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "99121567533606075055862966666024805091",
                "length":  1360
            },
            "id":  "ASB-A-461507723-f47218d7",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/avb/+/e8819556a9d3da7cb46005e9bbed970da4777455",
            "target":  {
                "file":  "libavb/avb_rsa.c",
                "function":  "modpowF4"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-461507723.json"