PUB-A-174801970

See a problem?
Import Source
https://storage.googleapis.com/android-osv/PUB-A-174801970.json
JSON Data
https://api.osv.dev/v1/vulns/PUB-A-174801970
Aliases
  • A-174801970
  • CVE-2021-0565
Published
2021-06-01T00:00:00Z
Modified
2024-11-06T12:16:03.231308Z
Summary
[none]
Details

In wrapUserThread of AudioStream.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/frameworks/av

Affected ranges

Type
ECOSYSTEM
Events
Introduced
11:0
Fixed
11:2021-06-01

Affected versions

Other

11

Ecosystem specific

{
    "vanir_signatures": [
        {
            "digest": {
                "length": 530.0,
                "function_hash": "139614980165858783589694880404695982359"
            },
            "id": "PUB-A-174801970-0b270cdc",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/4719048ce0e6f8656a417a2f2fe6fbb848ed2ba7",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "media/libaaudio/src/core/AAudioAudio.cpp",
                "function": "AAudioStream_close"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "length": 274.0,
                "function_hash": "284710114138898893703193932237953656032"
            },
            "id": "PUB-A-174801970-16b27f58",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/4719048ce0e6f8656a417a2f2fe6fbb848ed2ba7",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "media/libaaudio/src/legacy/AudioStreamTrack.cpp",
                "function": "AudioStreamTrack::release_l"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "length": 97.0,
                "function_hash": "236676239577778867338676764187553506754"
            },
            "id": "PUB-A-174801970-229af3c0",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/4719048ce0e6f8656a417a2f2fe6fbb848ed2ba7",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/oboeservice/AAudioServiceEndpointShared.cpp",
                "function": "AAudioServiceEndpointShared::close"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "281787820670727253720044660064265189921",
                    "143342773137027008245027694151827098079",
                    "306749727331442365831964329276630158966",
                    "63967917979503308382703250868214568103",
                    "69189987775076602422138647753946287361",
                    "316726849070947604139594672265102344743",
                    "66667391240581903173750653823879902866",
                    "140710104865231336921300119374505029733"
                ]
            },
            "id": "PUB-A-174801970-22aed5e0",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/4719048ce0e6f8656a417a2f2fe6fbb848ed2ba7",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/oboeservice/AAudioServiceEndpointMMAP.cpp"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "159915425677998633708360886071041163672",
                    "3986892579954722299164417327083767893",
                    "140940207752040076021843747509291126579",
                    "223665701398880327102818484047193900201"
                ]
            },
            "id": "PUB-A-174801970-2ac4d027",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/4719048ce0e6f8656a417a2f2fe6fbb848ed2ba7",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/oboeservice/AAudioServiceEndpointShared.h"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "296375467353242548125434776754048674851",
                    "65664169522638055013092614561735091607",
                    "278969325492621899834140624076187153221",
                    "249814952915921652371916458074287307756"
                ]
            },
            "id": "PUB-A-174801970-2c388b4d",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/4719048ce0e6f8656a417a2f2fe6fbb848ed2ba7",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "media/libaaudio/src/legacy/AudioStreamRecord.h"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "length": 303.0,
                "function_hash": "252823391997121911133119843026986017728"
            },
            "id": "PUB-A-174801970-2e8dd173",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/4719048ce0e6f8656a417a2f2fe6fbb848ed2ba7",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "media/libaaudio/src/legacy/AudioStreamRecord.cpp",
                "function": "AudioStreamRecord::release_l"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "196070555072885078025531739161228396812",
                    "105707448411985617085711894604898499451",
                    "219141087739992271262590372347779334917",
                    "337709641474310233833539692650250185840",
                    "204234232290178846221480071004427728321",
                    "83782044899816998109582882361696505381",
                    "29255303956425710426585226383074505739",
                    "306296291795229687390061121415270953153",
                    "3197286984077211218145784524474453525",
                    "8760325906087468587280988914679868245",
                    "28737448992954534201080666481094129598",
                    "229335509626786206742228878985831136557",
                    "117258452015463598987582681161627441770"
                ]
            },
            "id": "PUB-A-174801970-5e6bc746",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/4719048ce0e6f8656a417a2f2fe6fbb848ed2ba7",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "media/libaaudio/src/core/AudioStream.cpp"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "223268134181866597092427108202332905157",
                    "267773747500716155630585167499126441054",
                    "28889593610433508107303067648665805068",
                    "291211713123993845623855624406796100884",
                    "6009978050318666052114943795347715447",
                    "149179142162701876042379706921019170547",
                    "275345954108699826334096284439344895237",
                    "224397904416062749026560074139523022923",
                    "60640473735251624429728632760004895324"
                ]
            },
            "id": "PUB-A-174801970-6e1cee46",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/4719048ce0e6f8656a417a2f2fe6fbb848ed2ba7",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "media/libaaudio/src/legacy/AudioStreamTrack.cpp"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "138308000147954670255719411645784741841",
                    "3986892579954722299164417327083767893",
                    "140940207752040076021843747509291126579",
                    "223665701398880327102818484047193900201"
                ]
            },
            "id": "PUB-A-174801970-72fa1887",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/4719048ce0e6f8656a417a2f2fe6fbb848ed2ba7",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/oboeservice/AAudioServiceEndpointMMAP.h"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "54218227290195898416277200133252913724",
                    "7604587408120795285411780459083515618",
                    "295105256019524822658891580333570280404",
                    "84996635956053140685722718924996465929",
                    "186550684614668826600663661507058017790",
                    "54710912364336725460344946534482325683",
                    "286743222774800613961976126378028282434",
                    "228696837716531675267604384238019145671",
                    "269398634677032652687960495643418251450",
                    "263509510487563230553004999489355018061"
                ]
            },
            "id": "PUB-A-174801970-7d046996",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/4719048ce0e6f8656a417a2f2fe6fbb848ed2ba7",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "media/libaaudio/src/core/AAudioAudio.cpp"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "171233457037611892175862607637222469866",
                    "256975218576862948349205889735400132374",
                    "20251578944483618316344522367714113563",
                    "26513276847396811509644332421627523167",
                    "231837441837758898129077361407833656995",
                    "6009978050318666052114943795347715447",
                    "149179142162701876042379706921019170547",
                    "75515096408171148235770630775743236316",
                    "83318934688086468185599943590033350131",
                    "179292413493027094457110516288820655401"
                ]
            },
            "id": "PUB-A-174801970-809b7ddf",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/4719048ce0e6f8656a417a2f2fe6fbb848ed2ba7",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "media/libaaudio/src/legacy/AudioStreamRecord.cpp"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "length": 196.0,
                "function_hash": "176651214149299193849519549348812557642"
            },
            "id": "PUB-A-174801970-a3302ccd",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/4719048ce0e6f8656a417a2f2fe6fbb848ed2ba7",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/oboeservice/AAudioServiceEndpointMMAP.cpp",
                "function": "AAudioServiceEndpointMMAP::close"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "213551316154395914360255716971716142821",
                    "228993919608138147148651094441911975723",
                    "274089019340197142265383347135275664384",
                    "200599376122028488416001225785716372737",
                    "183272969719113907056488593423924321061",
                    "163593162470519578431894200678857127035",
                    "58795102209253700540829540757203641252",
                    "72328496922737768401131313389976931790",
                    "192458404849679491041311623473581514830",
                    "107160271459050059030427549802024824145",
                    "225231431714533303195368402847609328633",
                    "156985876278144894427900298786894737703",
                    "89269756142635332498121099473658481830",
                    "264973015085272474205707085502775081836",
                    "317674194016975262010493107589698527515",
                    "13851453484797678535523272752689633492",
                    "82559678301987930589556971359695608988",
                    "276295042054975172256098244072017151481",
                    "205230162382674081235505216231543887884",
                    "75843914492793173710546891834149904732"
                ]
            },
            "id": "PUB-A-174801970-ac9d2f4d",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/4719048ce0e6f8656a417a2f2fe6fbb848ed2ba7",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "media/libaaudio/src/core/AudioStream.h"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "21494141105392373684186664322719924188",
                    "40932097289607115560976628170179171166",
                    "75106859081186526841548216350425158146",
                    "236476705738012992469831647637151138698"
                ]
            },
            "id": "PUB-A-174801970-c8ce21b5",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/4719048ce0e6f8656a417a2f2fe6fbb848ed2ba7",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "media/libaaudio/src/legacy/AudioStreamTrack.h"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "100941249235493133634267842408171740297",
                    "128614695812127460621824038385563898139",
                    "258386942316292771493219030662458268846",
                    "304718278023657704757755727142482594956",
                    "273832504547236062963744445111622122488"
                ]
            },
            "id": "PUB-A-174801970-d80e6377",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/4719048ce0e6f8656a417a2f2fe6fbb848ed2ba7",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/oboeservice/AAudioServiceEndpointShared.cpp"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "74965827258306365781553929641278037141",
                    "75447487586561707643488323804274494615",
                    "140508897464051384633849615758231520693",
                    "35394968589167343693049559830880258211"
                ]
            },
            "id": "PUB-A-174801970-f98f503e",
            "source": "https://android.googlesource.com/platform/frameworks/av/+/4719048ce0e6f8656a417a2f2fe6fbb848ed2ba7",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/oboeservice/AAudioServiceEndpoint.h"
            },
            "signature_type": "Line"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/av/+/4719048ce0e6f8656a417a2f2fe6fbb848ed2ba7"
    ],
    "spl": "2021-06-01",
    "severity": "High",
    "types": [
        "EoP"
    ]
}