PUB-A-191191879

See a problem?
Import Source
https://storage.googleapis.com/android-osv/PUB-A-191191879.json
JSON Data
https://api.osv.dev/v1/vulns/PUB-A-191191879
Aliases
Published
2021-11-01T00:00:00Z
Modified
2025-11-10T16:36:10.937550Z
Summary
[none]
Details

In sctpwaitfor_sndbuf of socket.c, there is a possible use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / :linux_kernel:

Package

Name
:linux_kernel:

Affected ranges

Type
ECOSYSTEM
Events
Introduced
:0
Fixed
:2021-11-05

Affected versions

Other

Kernel

Ecosystem specific 

{
    "severity": "Moderate",
    "fixes": [
        "https://android.googlesource.com/kernel/common/+/a0ff660058b88d12625a783ce9e5c1371c87951f"
    ],
    "spl": "2021-11-05",
    "vanir_signatures": [
        {
            "signature_type": "Line",
            "target": {
                "file": "net/sctp/socket.c"
            },
            "signature_version": "v1",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "161440026640161238937255497205652366722",
                    "166896863108492209158237495159788846437",
                    "223860417456292450803140605217402891065",
                    "210456367631101530300657116600036694118",
                    "237777062920378449233657794985847342391",
                    "278012447065204218890908734041039357011",
                    "331614554834821072697861657940117163471",
                    "178650493169087938070146189829536330318",
                    "197076462926417907330935773542779761980",
                    "182760778930332685684967791520172818661",
                    "220600775586802911864186653955225149037",
                    "141603963500809161597629767413396204291",
                    "17767916853563208975470494862368186917",
                    "95108359713653449930249440349235487136",
                    "338354093051679488849685348264751873804",
                    "119929906587483203789517481165384647900",
                    "181648542817072038655607995641365685842",
                    "117359743880724450296820603826606463161",
                    "61748690895858767997432211545774538564",
                    "10858248066023894216951201326331096064",
                    "114951862003674669757708441705527890580",
                    "169792679937063316259977461247257911674",
                    "265710249301780992029112315883181302264",
                    "159087307297349208422956816081753698060",
                    "48545306500697272270179214074230945302",
                    "247653729167444084821210923403423765144",
                    "68147848313107386147661406810849818272",
                    "315023451341380403884119345778228100961",
                    "118403494614252980446332566965611223941"
                ]
            },
            "deprecated": false,
            "id": "PUB-A-191191879-62efbbcd",
            "source": "https://android.googlesource.com/kernel/common/+/a0ff660058b88d12625a783ce9e5c1371c87951f"
        },
        {
            "signature_type": "Function",
            "target": {
                "function": "sctp_wait_for_sndbuf",
                "file": "net/sctp/socket.c"
            },
            "signature_version": "v1",
            "digest": {
                "function_hash": "228276958924351202909308293677605884005",
                "length": 1086.0
            },
            "deprecated": false,
            "id": "PUB-A-191191879-991dd491",
            "source": "https://android.googlesource.com/kernel/common/+/a0ff660058b88d12625a783ce9e5c1371c87951f"
        },
        {
            "signature_type": "Function",
            "target": {
                "function": "sctp_sendmsg",
                "file": "net/sctp/socket.c"
            },
            "signature_version": "v1",
            "digest": {
                "function_hash": "162780646626966239124101143148513186694",
                "length": 7094.0
            },
            "deprecated": false,
            "id": "PUB-A-191191879-c08c347a",
            "source": "https://android.googlesource.com/kernel/common/+/a0ff660058b88d12625a783ce9e5c1371c87951f"
        }
    ],
    "types": [
        "EoP"
    ]
}