ASB-A-170315126
See a problem?- Import Source
- https://storage.googleapis.com/android-osv/ASB-A-170315126.json
- JSON Data
- https://api.osv.dev/v1/vulns/ASB-A-170315126
- Aliases
-
- A-170315126
- CVE-2021-0395
- Published
- 2021-03-01T00:00:00Z
- Modified
- 2024-08-07T19:30:18.008563Z
- Summary
- [UAF problem found in /system/bin/init] - HWASAN READ
- Details
-
In StopServicesAndLogViolations of reboot.cpp, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- References
Affected packages
Android / platform/system/core
Package
Ecosystem specific
{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"101818014862427381577138554774858772262",
"207897326174863112803967300073332032503",
"170161953132003358664881326098608296331",
"24068206641603555777020419771599127242"
]
},
"id": "ASB-A-170315126-0710ea3f",
"source": "https://android.googlesource.com/platform/system/core/+/71bd926bf0cbd8d823507f341cef9b71812afa66",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "init/service_list.h"
},
"signature_type": "Line"
},
{
"digest": {
"length": 481.0,
"function_hash": "98869663028328112784139905390724595869"
},
"id": "ASB-A-170315126-28610965",
"source": "https://android.googlesource.com/platform/system/core/+/71bd926bf0cbd8d823507f341cef9b71812afa66",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "init/reboot.cpp",
"function": "StopServices"
},
"signature_type": "Function"
},
{
"digest": {
"length": 2977.0,
"function_hash": "84227279810407167693213172987678305128"
},
"id": "ASB-A-170315126-3dddabff",
"source": "https://android.googlesource.com/platform/system/core/+/71bd926bf0cbd8d823507f341cef9b71812afa66",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "init/reboot.cpp",
"function": "DoUserspaceReboot"
},
"signature_type": "Function"
},
{
"digest": {
"length": 306.0,
"function_hash": "117464523494142376141973519505636429966"
},
"id": "ASB-A-170315126-443288f2",
"source": "https://android.googlesource.com/platform/system/core/+/71bd926bf0cbd8d823507f341cef9b71812afa66",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "init/reboot.cpp",
"function": "GetDebuggingServices"
},
"signature_type": "Function"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"14454701859505635237914742773638405357",
"22725118884313170336691100308924818642",
"274274452195862284735130254183770936702",
"1164188282948112794352967659731078977",
"182422952370255520473358283843423380761",
"275488499963182075357097872768066274742",
"132390911749597639286202865156701318453",
"320640993877312806486335467119514605073",
"52954961168965713283262921402118158432",
"154506595923974037068257278937457286087",
"301791718317874377160529863364702757466",
"84353386329419197010554723283256625863",
"264071436739099014901741031218088400264",
"113330960957016790855633053368370193036",
"318734625595210183526436391061177533566",
"146246532476520332758082787776896797193",
"329072052264011190259469182821171025730",
"244505118165297679195884080799220773587",
"65948687585007715375453518548591410839",
"309798047114207849138654827612389008235",
"289969497078260325038516535566577898332",
"97484096922789413549105158826761237639",
"5413908022753425328786071025507083600",
"15861911615933395728096458373983244227",
"50714230367856693359530578539961403144",
"81572141180443789027880752676831243811",
"218571862816419657535284481459004036573",
"47758857424019291395604397168452081777",
"1447250594360700498105155082597432754",
"191835217998857079536391497780223918213",
"239834975892676755119420548473039539758",
"62777769901471716397858675275432272136",
"100950077073405974980175084497010071110",
"134562864620764384360125123438545341216",
"167912644668902690902348890354378641351",
"331599620461619156697503223400997191725",
"116408375933419760995848381833996839763",
"135402533556941616861338252520967715652",
"41647802114001168191251665524643227687",
"285419186908599402189845657789927544729",
"238452965208084158841946187136852878121",
"67553776688500736886603265353891592906",
"161028463103890735288813179406665866558",
"300700032274715293109015615631224101150",
"275298724995735363444443492929125798468",
"44507632676042840863721543942872940143",
"339869511834216223251864209911135971340",
"168494930990366122121916551571221447088",
"82327728592695594994788903586269831194",
"79112052549857322848251940770765652795",
"27561719069042907686286569979125004271",
"183281376420712470311080007827696221480",
"208394069587037083232419734929407556828",
"178179068993283671446764371237765055916",
"222389430214267866880227228902503411154",
"52776617492928272226113714547418587838",
"318768909528653606850948281644795981487",
"54241199356697156900064262911057505071",
"248762490597494403347981083131883254238",
"208209325446362847679473510215396937031",
"44173835890863410462869392111137356646",
"98088988501590188067637778078053630300",
"161201764370310510123981185324979020509",
"213801979788598533312142009533760543207"
]
},
"id": "ASB-A-170315126-7029c736",
"source": "https://android.googlesource.com/platform/system/core/+/71bd926bf0cbd8d823507f341cef9b71812afa66",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "init/reboot.cpp"
},
"signature_type": "Line"
},
{
"digest": {
"length": 4064.0,
"function_hash": "127127543720237589350858382505695612173"
},
"id": "ASB-A-170315126-772ee5aa",
"source": "https://android.googlesource.com/platform/system/core/+/71bd926bf0cbd8d823507f341cef9b71812afa66",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "init/reboot.cpp",
"function": "DoReboot"
},
"signature_type": "Function"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"19501069722966756892686729097473902166",
"235478951550220196429973430710431383365",
"107349024263014985706475587337919995991",
"109345556365570852550703500436702944755"
]
},
"id": "ASB-A-170315126-7f7cc4e4",
"source": "https://android.googlesource.com/platform/system/core/+/71bd926bf0cbd8d823507f341cef9b71812afa66",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "init/lmkd_service.cpp"
},
"signature_type": "Line"
},
{
"digest": {
"length": 405.0,
"function_hash": "175995869797684222865030309436615914874"
},
"id": "ASB-A-170315126-83e86fad",
"source": "https://android.googlesource.com/platform/system/core/+/71bd926bf0cbd8d823507f341cef9b71812afa66",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "init/lmkd_service.cpp",
"function": "RegisterServices"
},
"signature_type": "Function"
},
{
"digest": {
"length": 520.0,
"function_hash": "267268939246538444835383077809100270823"
},
"id": "ASB-A-170315126-a4849300",
"source": "https://android.googlesource.com/platform/system/core/+/71bd926bf0cbd8d823507f341cef9b71812afa66",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "init/test_utils/service_utils.cpp",
"function": "GetOnDeviceServiceInterfacesMap"
},
"signature_type": "Function"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"200186127266085340462418191533813237632",
"256978330216403863698076647797034317721",
"160526710984397584566429606972116275685",
"85833283056325871135587548507299476000"
]
},
"id": "ASB-A-170315126-d3088c77",
"source": "https://android.googlesource.com/platform/system/core/+/71bd926bf0cbd8d823507f341cef9b71812afa66",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "init/test_utils/service_utils.cpp"
},
"signature_type": "Line"
},
{
"digest": {
"length": 402.0,
"function_hash": "63650763162028069325218665969106769933"
},
"id": "ASB-A-170315126-fe75aa73",
"source": "https://android.googlesource.com/platform/system/core/+/71bd926bf0cbd8d823507f341cef9b71812afa66",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "init/reboot.cpp",
"function": "StopServicesAndLogViolations"
},
"signature_type": "Function"
}
],
"fixes": [
"https://android.googlesource.com/platform/system/core/+/71bd926bf0cbd8d823507f341cef9b71812afa66"
],
"spl": "2021-03-01",
"severity": "High",
"types": [
"EoP"
]
}