PUB-A-205573273

See a problem?
Import Source
https://storage.googleapis.com/android-osv/PUB-A-205573273.json
JSON Data
https://api.osv.dev/v1/vulns/PUB-A-205573273
Aliases
Published
2022-08-01T00:00:00Z
Modified
2026-09-22T15:22:15Z
Summary
[none]
Details

In ion_buffer_kmap_get of ion.c, there is a possible use-after-free due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / :linux_kernel:

Package

Name
:linux_kernel:

Affected ranges

Type
ECOSYSTEM
Events
Introduced
:0
Fixed
:2022-08-05

Affected versions

Other
Kernel

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/kernel/common/+/721fb79e0eccd371a70054726dfe6931e6ed23e4",
        "https://android.googlesource.com/kernel/common/+/0d752f78b20dbe4eeb9bc76f118889f1898948ca",
        "https://android.googlesource.com/kernel/common/+/f48f8f7c3fdc21f34c45a7b3eeafb3109cf3340f",
        "https://android.googlesource.com/kernel/common/+/7f04e0c309811e762872a7ce71fba9cb359dd2c0",
        "https://android.googlesource.com/kernel/common/+/b6b3781a",
        "https://android.googlesource.com/kernel/common/+/618a931c"
    ],
    "severity":  "Moderate",
    "spl":  "2022-08-05",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "143589944968431461125676622989324634605",
                "length":  377
            },
            "id":  "PUB-A-205573273-09e8f23e",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/7f04e0c309811e762872a7ce71fba9cb359dd2c0",
            "target":  {
                "file":  "drivers/staging/android/ion/ion_buffer.c",
                "function":  "ion_buffer_kmap_get"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "4219159529549243608601486086579260767",
                "length":  410
            },
            "id":  "PUB-A-205573273-1f2ed4d0",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/618a931c",
            "target":  {
                "file":  "drivers/staging/android/ion/ion.c",
                "function":  "ion_buffer_kmap_get"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "4219159529549243608601486086579260767",
                "length":  410
            },
            "id":  "PUB-A-205573273-2f0f89ff",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/b6b3781a",
            "target":  {
                "file":  "drivers/staging/android/ion/ion.c",
                "function":  "ion_buffer_kmap_get"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "32066693641211963378462662023135189242",
                    "316971968143812374367631972781890494004",
                    "39606589143636630290617244170557724983",
                    "334251420500601506650157017286537155759"
                ],
                "threshold":  0.9
            },
            "id":  "PUB-A-205573273-37e0126f",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/721fb79e0eccd371a70054726dfe6931e6ed23e4",
            "target":  {
                "file":  "drivers/staging/android/ion/ion_buffer.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "143589944968431461125676622989324634605",
                "length":  377
            },
            "id":  "PUB-A-205573273-43d66593",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/721fb79e0eccd371a70054726dfe6931e6ed23e4",
            "target":  {
                "file":  "drivers/staging/android/ion/ion_buffer.c",
                "function":  "ion_buffer_kmap_get"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "32066693641211963378462662023135189242",
                    "316971968143812374367631972781890494004",
                    "39606589143636630290617244170557724983",
                    "334251420500601506650157017286537155759"
                ],
                "threshold":  0.9
            },
            "id":  "PUB-A-205573273-557f96a3",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/7f04e0c309811e762872a7ce71fba9cb359dd2c0",
            "target":  {
                "file":  "drivers/staging/android/ion/ion_buffer.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "65934957145507903299536105905483557201",
                    "316971968143812374367631972781890494004",
                    "39606589143636630290617244170557724983",
                    "334251420500601506650157017286537155759"
                ],
                "threshold":  0.9
            },
            "id":  "PUB-A-205573273-869d9f05",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/618a931c",
            "target":  {
                "file":  "drivers/staging/android/ion/ion.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "32066693641211963378462662023135189242",
                    "316971968143812374367631972781890494004",
                    "39606589143636630290617244170557724983",
                    "334251420500601506650157017286537155759"
                ],
                "threshold":  0.9
            },
            "id":  "PUB-A-205573273-8d505e31",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/0d752f78b20dbe4eeb9bc76f118889f1898948ca",
            "target":  {
                "file":  "drivers/staging/android/ion/ion_buffer.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "65934957145507903299536105905483557201",
                    "316971968143812374367631972781890494004",
                    "39606589143636630290617244170557724983",
                    "334251420500601506650157017286537155759"
                ],
                "threshold":  0.9
            },
            "id":  "PUB-A-205573273-8e5aa7fd",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/b6b3781a",
            "target":  {
                "file":  "drivers/staging/android/ion/ion.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "143589944968431461125676622989324634605",
                "length":  377
            },
            "id":  "PUB-A-205573273-9298d123",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/0d752f78b20dbe4eeb9bc76f118889f1898948ca",
            "target":  {
                "file":  "drivers/staging/android/ion/ion_buffer.c",
                "function":  "ion_buffer_kmap_get"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "32066693641211963378462662023135189242",
                    "316971968143812374367631972781890494004",
                    "39606589143636630290617244170557724983",
                    "334251420500601506650157017286537155759"
                ],
                "threshold":  0.9
            },
            "id":  "PUB-A-205573273-a4efcae2",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/f48f8f7c3fdc21f34c45a7b3eeafb3109cf3340f",
            "target":  {
                "file":  "drivers/staging/android/ion/ion_buffer.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "143589944968431461125676622989324634605",
                "length":  377
            },
            "id":  "PUB-A-205573273-fdd0d6c6",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/f48f8f7c3fdc21f34c45a7b3eeafb3109cf3340f",
            "target":  {
                "file":  "drivers/staging/android/ion/ion_buffer.c",
                "function":  "ion_buffer_kmap_get"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/PUB-A-205573273.json"