In accread of faccessory.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/kernel/common/+/0e3db17d01c9",
"https://android.googlesource.com/kernel/common/+/720da4ffe787",
"https://android.googlesource.com/kernel/common/+/dbf07d723528",
"https://android.googlesource.com/kernel/common/+/6be064d42c55",
"https://android.googlesource.com/kernel/common/+/1edd54563125",
"https://android.googlesource.com/kernel/common/+/1077960495b9",
"https://android.googlesource.com/kernel/common/+/86c87779ede4",
"https://android.googlesource.com/kernel/common/+/4df1d2ffe176",
"https://android.googlesource.com/kernel/common/+/cd4f43077085",
"https://android.googlesource.com/kernel/common/+/ff729a0610eb",
"https://android.googlesource.com/kernel/common/+/429fec28c835",
"https://android.googlesource.com/kernel/common/+/25670eded84f"
],
"types": [
"EoP"
],
"severity": "Moderate",
"vanir_signatures": [
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "279573375294129927117975402795247661419",
"length": 52.0
},
"id": "PUB-A-173789633-01a39098",
"signature_type": "Function",
"source": "https://android.googlesource.com/kernel/common/+/1077960495b9",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c",
"function": "acc_disconnect"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"329176042677885532997597016490515164028",
"175416201952969528708604516036208093782",
"171230555072931899182265957580069056242",
"167972328886195659874335214974250126888",
"11521267093215324045342603276188646885",
"158838512720101526626234890442746082672",
"149537120580437362732553141059500123550",
"40814617619707303072047564723427521789"
]
},
"id": "PUB-A-173789633-036942c6",
"signature_type": "Line",
"source": "https://android.googlesource.com/kernel/common/+/1edd54563125",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "161602190224956284117109839124976043866",
"length": 577.0
},
"id": "PUB-A-173789633-061c95db",
"signature_type": "Function",
"source": "https://android.googlesource.com/kernel/common/+/1077960495b9",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c",
"function": "acc_alloc"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "55051712581155407018128269515842731711",
"length": 609.0
},
"id": "PUB-A-173789633-11e04751",
"signature_type": "Function",
"source": "https://android.googlesource.com/kernel/common/+/1077960495b9",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c",
"function": "kill_all_hid_devices"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"215672663632879508606623366912157068169",
"186478080489503428372413310554891772388",
"128859826572062116182779899698829062989"
]
},
"id": "PUB-A-173789633-158f4afb",
"signature_type": "Line",
"source": "https://android.googlesource.com/kernel/common/+/720da4ffe787",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"108310348490818699135683826558460394405",
"79220267752915886126141714325427207010",
"153155817419365817600100548793949742139",
"251317940461538278480018655502638587918",
"292167515811365053051695278262338154475",
"281048598620739317140795494297455778675"
]
},
"id": "PUB-A-173789633-1b2154a5",
"signature_type": "Line",
"source": "https://android.googlesource.com/kernel/common/+/4df1d2ffe176",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"225280387054771498040711883514299103539",
"338029648715251077337236046497805221014",
"231428083309234813312314676047858971596",
"239082514514332122697564833081155984674",
"333464466830375400101518805722046450000",
"220898788528219207629834577917677243618",
"99266217647415879143241271854407042404",
"54820754507410261895607310650434837850",
"176868186422294035190594138695550528846",
"278869243216320879839567996700964112915",
"288719446275705524243647104815623172371",
"52240541542814999086278516042044035544",
"102155258732891949040129174078201522932",
"164513056209429703672633092893548716571",
"85953201927160044302320775114963989657",
"124367776676533131628716551660317227300",
"239707360849959353696324427085543024763",
"227945880565333665273011189726399282413",
"175745266127218352081403176540825933327"
]
},
"id": "PUB-A-173789633-2c02fede",
"signature_type": "Line",
"source": "https://android.googlesource.com/kernel/common/+/6be064d42c55",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "214156672846589642432261441410823048507",
"length": 55.0
},
"id": "PUB-A-173789633-310ff590",
"signature_type": "Function",
"source": "https://android.googlesource.com/kernel/common/+/86c87779ede4",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c",
"function": "get_acc_dev"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"199277018618310017249489306658455136567",
"18836903526420782498384749681514613892",
"56778512481961073852773692375370850041",
"127269775524920307282639947715643341104",
"217292869288749869524074971462346278296"
]
},
"id": "PUB-A-173789633-31fe0c7a",
"signature_type": "Line",
"source": "https://android.googlesource.com/kernel/common/+/429fec28c835",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "274548294608321144123139584427324593204",
"length": 513.0
},
"id": "PUB-A-173789633-3e7e6712",
"signature_type": "Function",
"source": "https://android.googlesource.com/kernel/common/+/6be064d42c55",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c",
"function": "acc_alloc_inst"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "34258552306332870327438217232589610117",
"length": 1182.0
},
"id": "PUB-A-173789633-3eff660e",
"signature_type": "Function",
"source": "https://android.googlesource.com/kernel/common/+/1077960495b9",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c",
"function": "acc_hid_work"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "101226067179639114581684757169463940691",
"length": 3051.0
},
"id": "PUB-A-173789633-4002df4a",
"signature_type": "Function",
"source": "https://android.googlesource.com/kernel/common/+/720da4ffe787",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c",
"function": "acc_ctrlrequest"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "5294480541145421460995016664931264088",
"length": 249.0
},
"id": "PUB-A-173789633-4672684f",
"signature_type": "Function",
"source": "https://android.googlesource.com/kernel/common/+/1077960495b9",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c",
"function": "acc_complete_out"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "291541760956646495333208991088960723389",
"length": 705.0
},
"id": "PUB-A-173789633-46ee423c",
"signature_type": "Function",
"source": "https://android.googlesource.com/kernel/common/+/86c87779ede4",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c",
"function": "acc_setup"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "40890220871173376627781973415442057051",
"length": 274.0
},
"id": "PUB-A-173789633-57c30b39",
"signature_type": "Function",
"source": "https://android.googlesource.com/kernel/common/+/1077960495b9",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c",
"function": "acc_complete_in"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "172964226687015884769848006156827194982",
"length": 105.0
},
"id": "PUB-A-173789633-66f66ec3",
"signature_type": "Function",
"source": "https://android.googlesource.com/kernel/common/+/1077960495b9",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c",
"function": "acc_cleanup"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "221603667839994231401525193644784331007",
"length": 198.0
},
"id": "PUB-A-173789633-723c60f4",
"signature_type": "Function",
"source": "https://android.googlesource.com/kernel/common/+/6be064d42c55",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c",
"function": "acc_release"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "121063076792556779298682600788297210471",
"length": 159.0
},
"id": "PUB-A-173789633-84df6256",
"signature_type": "Function",
"source": "https://android.googlesource.com/kernel/common/+/1077960495b9",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c",
"function": "acc_release"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"80973308283216350084901682413025290546",
"161123754182796235034257107647732732229",
"86141659631471755541859395915138283609",
"305127743595501064649366958755203497868",
"37442932356505892489203117604277769963",
"10402241341226332436636062893299295728",
"133348254535191320865660709450539154329",
"181089549712643786636121484127211293347",
"11625725501927820212408575520155436467",
"287078264794316135461181848871018288743",
"220262828000668887477953940981392439249",
"207368043647783632822057176425213756501",
"68198314446334396045280580472711326819",
"27966234336950527458165450659220203083",
"120853349636756857406725766720311012698",
"89627749151935867129649054380371626129",
"299596652205890407605559035363419822757",
"214040787817205036163519537903030775549",
"182609624531698009484398444092384341137",
"79120997930939005188756532989681908126",
"282013179047115175643439847914755114669",
"319395303225862310901078210461528289552",
"257029001298206106002152206635951271701",
"71077880261361771833728969679405921606",
"241945894057949935143895186444619702092",
"81259125415460467721123081923839550610",
"56709248024964498132480304372876847330",
"117108435526431240916474368244379226244",
"134441425976998112502935890134481439844",
"99340749787632912217123304782189744224",
"196330285106561607045016004459444751853",
"41871355835792255319292473503054479464",
"245977861112248608596196020223975494334",
"145525893212304874514063185511989208672",
"221182159638717473909042608575663564011",
"283021829530578018823808006695715945734",
"242328473478772804395432122581859339562",
"317683038112915875315939208308825290861",
"222339134022901475544928890108957854195",
"261773103525071760761224755306090026850",
"124341601484280613372131885371660096534",
"273834874948328061969506126259940324562",
"83690905670512582542783079671446145660",
"301830052659045526970721464685540989854",
"194615885144012838642701261512971191136",
"107176523982121969699138987819404359495",
"267421401863107236225866804505412785326",
"236674396378347081161531121596530352295",
"257665925652917890154894707895503242282",
"141002620887249307846770251611511811169",
"171316668514609509828619908859592745775",
"159309810256146607221929394448029561968",
"290260152617207878451141244833996362998",
"67275079680244802686277809070650302089",
"203742714421042195677622120831314152141",
"269658793582941248104386316956858109660",
"6417456291597090451887379760921534753",
"253106458328318007248093016295514698743",
"50471322316676896568142521210247804702",
"2347038799379029272494540942216398626",
"152047359806167457144050208559230291639",
"25536915549073483472926970924525006826",
"216400667982334006584775394315242381393",
"337111627251520984090274939691262964152",
"299071438506641552632877452077608174551",
"218570944242656746580714577418721198430",
"2680210074228976561182507903945137791",
"256756068135769066065373432690347942266",
"255221119662219709807504062470412908855",
"293269022782565890101603338416075517756",
"257026802285368485499015704851449944892",
"156324871213126383742402486725675284001",
"149832062111026508906297085708603660407",
"268012044311978950626978776008438339593",
"139615036458819262717243694511840829110"
]
},
"id": "PUB-A-173789633-88f07e66",
"signature_type": "Line",
"source": "https://android.googlesource.com/kernel/common/+/1077960495b9",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"201027383088299859670433299470330444866",
"94086078636034697017366320762187688095",
"295292840792122668350733543017841054724"
]
},
"id": "PUB-A-173789633-8a43e475",
"signature_type": "Line",
"source": "https://android.googlesource.com/kernel/common/+/ff729a0610eb",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "81016612811925308106286135931010505640",
"length": 198.0
},
"id": "PUB-A-173789633-911f1dc8",
"signature_type": "Function",
"source": "https://android.googlesource.com/kernel/common/+/ff729a0610eb",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c",
"function": "__put_acc_dev"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"306559110968900426291308775095398483727",
"203132980914257132302134881987473346993",
"310830643122438752195149669627051148642",
"34351044059361103331203337142634128628",
"311533648554766309421481942752656471034",
"276585744605524618041943754245238764986",
"90020528557353257149201041878435646725",
"267654304422182773765043395974142476010",
"4919430911460173360479436791740065756",
"241670359760903220424520396030375137711",
"272818275174588323769655087757036510553",
"167403152045530133128033703877608347807",
"179841438393473926070423083560134747146",
"19263433213219346313064451755856223543",
"219074172486748041834057817328030897802",
"24615551318589620680107609096802310837",
"296884202403981221771769600527349246048",
"259543841281273942134108682499427369065",
"25219198395614784086023706586573394957",
"268344055729065849696654543659019735460",
"28151460759339288567240306177951893932",
"261766680795571747170221012937463986854",
"69118756463579661424894599415748278119",
"224752371854238271332539997354955835366",
"142448041894066843970882186500162066634",
"142176963944207303376938721928147568259",
"205750098245058738957834178283608438505",
"193139242793887258578789319287615414502",
"278339472661958510394658862645443364351",
"12315185500467096445888667780554218270",
"30813014460931759171884410993424020719",
"131282686113709134191957317080302848054",
"99391859293803735200091802921304808076",
"190609360190360073590403437486349894072",
"80391178793852306016505830800943326801"
]
},
"id": "PUB-A-173789633-929d5a8d",
"signature_type": "Line",
"source": "https://android.googlesource.com/kernel/common/+/86c87779ede4",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "142751328338696319295454209520228408255",
"length": 1417.0
},
"id": "PUB-A-173789633-947e51d7",
"signature_type": "Function",
"source": "https://android.googlesource.com/kernel/common/+/0e3db17d01c9",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c",
"function": "acc_read"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "313164438804567980833356234042607791663",
"length": 237.0
},
"id": "PUB-A-173789633-9938cfb0",
"signature_type": "Function",
"source": "https://android.googlesource.com/kernel/common/+/6be064d42c55",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c",
"function": "acc_open"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"99511659798888220427413191008775602921",
"78030160576134777173838191332541366391",
"92522794851270869947707763062363417956",
"231262410329632453773619299775833641623",
"185233960916934152042894300509694864887",
"131978156509354697434261904349361312561",
"254984408652555673390041710440684029131",
"220662784971745328608207086760791609207",
"211452470945239743430373514931085296098",
"83662502570095913021076849701162187584",
"214297902815083786796762446154275795394",
"245684067580538777689162184086731985262",
"144420834628611866634902259388042759390"
]
},
"id": "PUB-A-173789633-99f53f7d",
"signature_type": "Line",
"source": "https://android.googlesource.com/kernel/common/+/cd4f43077085",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "244513687000800306875284609571499632961",
"length": 470.0
},
"id": "PUB-A-173789633-a2e15727",
"signature_type": "Function",
"source": "https://android.googlesource.com/kernel/common/+/1edd54563125",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c",
"function": "acc_alloc_inst"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "11715419900891474083437334645968674708",
"length": 606.0
},
"id": "PUB-A-173789633-aa6e93c0",
"signature_type": "Function",
"source": "https://android.googlesource.com/kernel/common/+/6be064d42c55",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c",
"function": "acc_alloc"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "217972392428191533438348063416345450734",
"length": 106.0
},
"id": "PUB-A-173789633-b3ffff24",
"signature_type": "Function",
"source": "https://android.googlesource.com/kernel/common/+/25670eded84f",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c",
"function": "acc_disconnect"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"272765753433766838614642813003801021066",
"20601298892892226623329639156900440930",
"103846371464086363074748064683469646819",
"52724637744533510133221108826589173022",
"138194968154935274471023235123753226879"
]
},
"id": "PUB-A-173789633-b9d459a5",
"signature_type": "Line",
"source": "https://android.googlesource.com/kernel/common/+/25670eded84f",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "254831499654329404004550373258984259194",
"length": 201.0
},
"id": "PUB-A-173789633-bc4ba105",
"signature_type": "Function",
"source": "https://android.googlesource.com/kernel/common/+/1077960495b9",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c",
"function": "acc_open"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "177034144749790760240925624870019203172",
"length": 144.0
},
"id": "PUB-A-173789633-beee4a7f",
"signature_type": "Function",
"source": "https://android.googlesource.com/kernel/common/+/86c87779ede4",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c",
"function": "acc_cleanup"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "160855479261727884438025847524474296333",
"length": 268.0
},
"id": "PUB-A-173789633-d8341f2b",
"signature_type": "Function",
"source": "https://android.googlesource.com/kernel/common/+/4df1d2ffe176",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c",
"function": "acc_release"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "27635971431877382704795134745544286558",
"length": 790.0
},
"id": "PUB-A-173789633-dc14199a",
"signature_type": "Function",
"source": "https://android.googlesource.com/kernel/common/+/cd4f43077085",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c",
"function": "acc_setup"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"140308446630451644528801151792931662834",
"114133813539291430447131308980696013209",
"252412203994580860281692131865015111733",
"299247135128080025173321024425301571465",
"85466051250627125533310295699359742959",
"53287002911792818201744421287550361918",
"158794573723165773490886874374483416292",
"298284233106041496378622858292499059917",
"239163834701112662141222423482763376154",
"56381590121950270574837864510528584802",
"145324204004733214215247582351705639456"
]
},
"id": "PUB-A-173789633-dea738a8",
"signature_type": "Line",
"source": "https://android.googlesource.com/kernel/common/+/0e3db17d01c9",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "179062135972240512280212428250194372785",
"length": 3082.0
},
"id": "PUB-A-173789633-e55537f6",
"signature_type": "Function",
"source": "https://android.googlesource.com/kernel/common/+/1077960495b9",
"target": {
"file": "drivers/usb/gadget/function/f_accessory.c",
"function": "acc_ctrlrequest"
}
}
],
"spl": "2021-10-05"
}