In accread of faccessory.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "vanir_signatures": [ { "digest": { "length": 52.0, "function_hash": "279573375294129927117975402795247661419" }, "id": "PUB-A-173789633-01a39098", "source": "https://android.googlesource.com/kernel/common/+/1077960495b9", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c", "function": "acc_disconnect" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "329176042677885532997597016490515164028", "175416201952969528708604516036208093782", "171230555072931899182265957580069056242", "167972328886195659874335214974250126888", "11521267093215324045342603276188646885", "158838512720101526626234890442746082672", "149537120580437362732553141059500123550", "40814617619707303072047564723427521789" ] }, "id": "PUB-A-173789633-036942c6", "source": "https://android.googlesource.com/kernel/common/+/1edd54563125", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c" }, "signature_type": "Line" }, { "digest": { "length": 577.0, "function_hash": "161602190224956284117109839124976043866" }, "id": "PUB-A-173789633-061c95db", "source": "https://android.googlesource.com/kernel/common/+/1077960495b9", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c", "function": "acc_alloc" }, "signature_type": "Function" }, { "digest": { "length": 609.0, "function_hash": "55051712581155407018128269515842731711" }, "id": "PUB-A-173789633-11e04751", "source": "https://android.googlesource.com/kernel/common/+/1077960495b9", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c", "function": "kill_all_hid_devices" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "215672663632879508606623366912157068169", "186478080489503428372413310554891772388", "128859826572062116182779899698829062989" ] }, "id": "PUB-A-173789633-158f4afb", "source": "https://android.googlesource.com/kernel/common/+/720da4ffe787", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c" }, "signature_type": "Line" }, { "digest": { "threshold": 0.9, "line_hashes": [ "108310348490818699135683826558460394405", "79220267752915886126141714325427207010", "153155817419365817600100548793949742139", "251317940461538278480018655502638587918", "292167515811365053051695278262338154475", "281048598620739317140795494297455778675" ] }, "id": "PUB-A-173789633-1b2154a5", "source": "https://android.googlesource.com/kernel/common/+/4df1d2ffe176", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c" }, "signature_type": "Line" }, { "digest": { "threshold": 0.9, "line_hashes": [ "225280387054771498040711883514299103539", "338029648715251077337236046497805221014", "231428083309234813312314676047858971596", "239082514514332122697564833081155984674", "333464466830375400101518805722046450000", "220898788528219207629834577917677243618", "99266217647415879143241271854407042404", "54820754507410261895607310650434837850", "176868186422294035190594138695550528846", "278869243216320879839567996700964112915", "288719446275705524243647104815623172371", "52240541542814999086278516042044035544", "102155258732891949040129174078201522932", "164513056209429703672633092893548716571", "85953201927160044302320775114963989657", "124367776676533131628716551660317227300", "239707360849959353696324427085543024763", "227945880565333665273011189726399282413", "175745266127218352081403176540825933327" ] }, "id": "PUB-A-173789633-2c02fede", "source": "https://android.googlesource.com/kernel/common/+/6be064d42c55", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c" }, "signature_type": "Line" }, { "digest": { "length": 55.0, "function_hash": "214156672846589642432261441410823048507" }, "id": "PUB-A-173789633-310ff590", "source": "https://android.googlesource.com/kernel/common/+/86c87779ede4", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c", "function": "get_acc_dev" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "199277018618310017249489306658455136567", "18836903526420782498384749681514613892", "56778512481961073852773692375370850041", "127269775524920307282639947715643341104", "217292869288749869524074971462346278296" ] }, "id": "PUB-A-173789633-31fe0c7a", "source": "https://android.googlesource.com/kernel/common/+/429fec28c835", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c" }, "signature_type": "Line" }, { "digest": { "length": 513.0, "function_hash": "274548294608321144123139584427324593204" }, "id": "PUB-A-173789633-3e7e6712", "source": "https://android.googlesource.com/kernel/common/+/6be064d42c55", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c", "function": "acc_alloc_inst" }, "signature_type": "Function" }, { "digest": { "length": 1182.0, "function_hash": "34258552306332870327438217232589610117" }, "id": "PUB-A-173789633-3eff660e", "source": "https://android.googlesource.com/kernel/common/+/1077960495b9", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c", "function": "acc_hid_work" }, "signature_type": "Function" }, { "digest": { "length": 3051.0, "function_hash": "101226067179639114581684757169463940691" }, "id": "PUB-A-173789633-4002df4a", "source": "https://android.googlesource.com/kernel/common/+/720da4ffe787", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c", "function": "acc_ctrlrequest" }, "signature_type": "Function" }, { "digest": { "length": 249.0, "function_hash": "5294480541145421460995016664931264088" }, "id": "PUB-A-173789633-4672684f", "source": "https://android.googlesource.com/kernel/common/+/1077960495b9", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c", "function": "acc_complete_out" }, "signature_type": "Function" }, { "digest": { "length": 705.0, "function_hash": "291541760956646495333208991088960723389" }, "id": "PUB-A-173789633-46ee423c", "source": "https://android.googlesource.com/kernel/common/+/86c87779ede4", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c", "function": "acc_setup" }, "signature_type": "Function" }, { "digest": { "length": 274.0, "function_hash": "40890220871173376627781973415442057051" }, "id": "PUB-A-173789633-57c30b39", "source": "https://android.googlesource.com/kernel/common/+/1077960495b9", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c", "function": "acc_complete_in" }, "signature_type": "Function" }, { "digest": { "length": 105.0, "function_hash": "172964226687015884769848006156827194982" }, "id": "PUB-A-173789633-66f66ec3", "source": "https://android.googlesource.com/kernel/common/+/1077960495b9", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c", "function": "acc_cleanup" }, "signature_type": "Function" }, { "digest": { "length": 198.0, "function_hash": "221603667839994231401525193644784331007" }, "id": "PUB-A-173789633-723c60f4", "source": "https://android.googlesource.com/kernel/common/+/6be064d42c55", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c", "function": "acc_release" }, "signature_type": "Function" }, { "digest": { "length": 159.0, "function_hash": "121063076792556779298682600788297210471" }, "id": "PUB-A-173789633-84df6256", "source": "https://android.googlesource.com/kernel/common/+/1077960495b9", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c", "function": "acc_release" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "80973308283216350084901682413025290546", "161123754182796235034257107647732732229", "86141659631471755541859395915138283609", "305127743595501064649366958755203497868", "37442932356505892489203117604277769963", "10402241341226332436636062893299295728", "133348254535191320865660709450539154329", "181089549712643786636121484127211293347", "11625725501927820212408575520155436467", "287078264794316135461181848871018288743", "220262828000668887477953940981392439249", "207368043647783632822057176425213756501", "68198314446334396045280580472711326819", "27966234336950527458165450659220203083", "120853349636756857406725766720311012698", "89627749151935867129649054380371626129", "299596652205890407605559035363419822757", "214040787817205036163519537903030775549", "182609624531698009484398444092384341137", "79120997930939005188756532989681908126", "282013179047115175643439847914755114669", "319395303225862310901078210461528289552", "257029001298206106002152206635951271701", "71077880261361771833728969679405921606", "241945894057949935143895186444619702092", "81259125415460467721123081923839550610", "56709248024964498132480304372876847330", "117108435526431240916474368244379226244", "134441425976998112502935890134481439844", "99340749787632912217123304782189744224", "196330285106561607045016004459444751853", "41871355835792255319292473503054479464", "245977861112248608596196020223975494334", "145525893212304874514063185511989208672", "221182159638717473909042608575663564011", "283021829530578018823808006695715945734", "242328473478772804395432122581859339562", "317683038112915875315939208308825290861", "222339134022901475544928890108957854195", "261773103525071760761224755306090026850", "124341601484280613372131885371660096534", "273834874948328061969506126259940324562", "83690905670512582542783079671446145660", "301830052659045526970721464685540989854", "194615885144012838642701261512971191136", "107176523982121969699138987819404359495", "267421401863107236225866804505412785326", "236674396378347081161531121596530352295", "257665925652917890154894707895503242282", "141002620887249307846770251611511811169", "171316668514609509828619908859592745775", "159309810256146607221929394448029561968", "290260152617207878451141244833996362998", "67275079680244802686277809070650302089", "203742714421042195677622120831314152141", "269658793582941248104386316956858109660", "6417456291597090451887379760921534753", "253106458328318007248093016295514698743", "50471322316676896568142521210247804702", "2347038799379029272494540942216398626", "152047359806167457144050208559230291639", "25536915549073483472926970924525006826", "216400667982334006584775394315242381393", "337111627251520984090274939691262964152", "299071438506641552632877452077608174551", "218570944242656746580714577418721198430", "2680210074228976561182507903945137791", "256756068135769066065373432690347942266", "255221119662219709807504062470412908855", "293269022782565890101603338416075517756", "257026802285368485499015704851449944892", "156324871213126383742402486725675284001", "149832062111026508906297085708603660407", "268012044311978950626978776008438339593", "139615036458819262717243694511840829110" ] }, "id": "PUB-A-173789633-88f07e66", "source": "https://android.googlesource.com/kernel/common/+/1077960495b9", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c" }, "signature_type": "Line" }, { "digest": { "threshold": 0.9, "line_hashes": [ "201027383088299859670433299470330444866", "94086078636034697017366320762187688095", "295292840792122668350733543017841054724" ] }, "id": "PUB-A-173789633-8a43e475", "source": "https://android.googlesource.com/kernel/common/+/ff729a0610eb", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c" }, "signature_type": "Line" }, { "digest": { "length": 198.0, "function_hash": "81016612811925308106286135931010505640" }, "id": "PUB-A-173789633-911f1dc8", "source": "https://android.googlesource.com/kernel/common/+/ff729a0610eb", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c", "function": "__put_acc_dev" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "306559110968900426291308775095398483727", "203132980914257132302134881987473346993", "310830643122438752195149669627051148642", "34351044059361103331203337142634128628", "311533648554766309421481942752656471034", "276585744605524618041943754245238764986", "90020528557353257149201041878435646725", "267654304422182773765043395974142476010", "4919430911460173360479436791740065756", "241670359760903220424520396030375137711", "272818275174588323769655087757036510553", "167403152045530133128033703877608347807", "179841438393473926070423083560134747146", "19263433213219346313064451755856223543", "219074172486748041834057817328030897802", "24615551318589620680107609096802310837", "296884202403981221771769600527349246048", "259543841281273942134108682499427369065", "25219198395614784086023706586573394957", "268344055729065849696654543659019735460", "28151460759339288567240306177951893932", "261766680795571747170221012937463986854", "69118756463579661424894599415748278119", "224752371854238271332539997354955835366", "142448041894066843970882186500162066634", "142176963944207303376938721928147568259", "205750098245058738957834178283608438505", "193139242793887258578789319287615414502", "278339472661958510394658862645443364351", "12315185500467096445888667780554218270", "30813014460931759171884410993424020719", "131282686113709134191957317080302848054", "99391859293803735200091802921304808076", "190609360190360073590403437486349894072", "80391178793852306016505830800943326801" ] }, "id": "PUB-A-173789633-929d5a8d", "source": "https://android.googlesource.com/kernel/common/+/86c87779ede4", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c" }, "signature_type": "Line" }, { "digest": { "length": 1417.0, "function_hash": "142751328338696319295454209520228408255" }, "id": "PUB-A-173789633-947e51d7", "source": "https://android.googlesource.com/kernel/common/+/0e3db17d01c9", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c", "function": "acc_read" }, "signature_type": "Function" }, { "digest": { "length": 237.0, "function_hash": "313164438804567980833356234042607791663" }, "id": "PUB-A-173789633-9938cfb0", "source": "https://android.googlesource.com/kernel/common/+/6be064d42c55", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c", "function": "acc_open" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "99511659798888220427413191008775602921", "78030160576134777173838191332541366391", "92522794851270869947707763062363417956", "231262410329632453773619299775833641623", "185233960916934152042894300509694864887", "131978156509354697434261904349361312561", "254984408652555673390041710440684029131", "220662784971745328608207086760791609207", "211452470945239743430373514931085296098", "83662502570095913021076849701162187584", "214297902815083786796762446154275795394", "245684067580538777689162184086731985262", "144420834628611866634902259388042759390" ] }, "id": "PUB-A-173789633-99f53f7d", "source": "https://android.googlesource.com/kernel/common/+/cd4f43077085", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c" }, "signature_type": "Line" }, { "digest": { "length": 470.0, "function_hash": "244513687000800306875284609571499632961" }, "id": "PUB-A-173789633-a2e15727", "source": "https://android.googlesource.com/kernel/common/+/1edd54563125", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c", "function": "acc_alloc_inst" }, "signature_type": "Function" }, { "digest": { "length": 606.0, "function_hash": "11715419900891474083437334645968674708" }, "id": "PUB-A-173789633-aa6e93c0", "source": "https://android.googlesource.com/kernel/common/+/6be064d42c55", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c", "function": "acc_alloc" }, "signature_type": "Function" }, { "digest": { "length": 106.0, "function_hash": "217972392428191533438348063416345450734" }, "id": "PUB-A-173789633-b3ffff24", "source": "https://android.googlesource.com/kernel/common/+/25670eded84f", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c", "function": "acc_disconnect" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "272765753433766838614642813003801021066", "20601298892892226623329639156900440930", "103846371464086363074748064683469646819", "52724637744533510133221108826589173022", "138194968154935274471023235123753226879" ] }, "id": "PUB-A-173789633-b9d459a5", "source": "https://android.googlesource.com/kernel/common/+/25670eded84f", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c" }, "signature_type": "Line" }, { "digest": { "length": 201.0, "function_hash": "254831499654329404004550373258984259194" }, "id": "PUB-A-173789633-bc4ba105", "source": "https://android.googlesource.com/kernel/common/+/1077960495b9", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c", "function": "acc_open" }, "signature_type": "Function" }, { "digest": { "length": 144.0, "function_hash": "177034144749790760240925624870019203172" }, "id": "PUB-A-173789633-beee4a7f", "source": "https://android.googlesource.com/kernel/common/+/86c87779ede4", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c", "function": "acc_cleanup" }, "signature_type": "Function" }, { "digest": { "length": 268.0, "function_hash": "160855479261727884438025847524474296333" }, "id": "PUB-A-173789633-d8341f2b", "source": "https://android.googlesource.com/kernel/common/+/4df1d2ffe176", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c", "function": "acc_release" }, "signature_type": "Function" }, { "digest": { "length": 790.0, "function_hash": "27635971431877382704795134745544286558" }, "id": "PUB-A-173789633-dc14199a", "source": "https://android.googlesource.com/kernel/common/+/cd4f43077085", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c", "function": "acc_setup" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "140308446630451644528801151792931662834", "114133813539291430447131308980696013209", "252412203994580860281692131865015111733", "299247135128080025173321024425301571465", "85466051250627125533310295699359742959", "53287002911792818201744421287550361918", "158794573723165773490886874374483416292", "298284233106041496378622858292499059917", "239163834701112662141222423482763376154", "56381590121950270574837864510528584802", "145324204004733214215247582351705639456" ] }, "id": "PUB-A-173789633-dea738a8", "source": "https://android.googlesource.com/kernel/common/+/0e3db17d01c9", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c" }, "signature_type": "Line" }, { "digest": { "length": 3082.0, "function_hash": "179062135972240512280212428250194372785" }, "id": "PUB-A-173789633-e55537f6", "source": "https://android.googlesource.com/kernel/common/+/1077960495b9", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/usb/gadget/function/f_accessory.c", "function": "acc_ctrlrequest" }, "signature_type": "Function" } ], "fixes": [ "https://android.googlesource.com/kernel/common/+/0e3db17d01c9", "https://android.googlesource.com/kernel/common/+/720da4ffe787", "https://android.googlesource.com/kernel/common/+/dbf07d723528", "https://android.googlesource.com/kernel/common/+/6be064d42c55", "https://android.googlesource.com/kernel/common/+/1edd54563125", "https://android.googlesource.com/kernel/common/+/1077960495b9", "https://android.googlesource.com/kernel/common/+/86c87779ede4", "https://android.googlesource.com/kernel/common/+/4df1d2ffe176", "https://android.googlesource.com/kernel/common/+/cd4f43077085", "https://android.googlesource.com/kernel/common/+/ff729a0610eb", "https://android.googlesource.com/kernel/common/+/429fec28c835", "https://android.googlesource.com/kernel/common/+/25670eded84f" ], "spl": "2021-10-05", "severity": "Moderate", "types": [ "EoP" ] }