In queue of UsbRequest.java, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "vanir_signatures": [ { "digest": { "length": 137.0, "function_hash": "7269847508204790583515434263233829328" }, "id": "ASB-A-204584366-0fb3334e", "source": "https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java", "function": "close" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "276104590878752660397844813354367309942", "172353618839433354333431412538164318901", "95659188306839718572831588354300332447", "81174342330019458445585225794288420398", "83413780435536255958580647457844443009", "293719345425021902667665909660676045871", "130247754382031353055193230757160205950", "152408938682014877718961330328601492680", "162884205329918340703727952116933440069", "330292456763100805398861730204970328556", "79502387876862938617658865185021275675", "284502899353952226313921425102556205516", "123811250654480706403060173047200929721", "134860343233762423206591019317333971400", "6153809002853348190614076489219735788", "215798567649815907614467130438533073310", "76626048380436355668606965215724175700", "139727142540396795720220278206414238800", "158028791905717405744513745681220166310", "315864079412228123039281842188659089958", "258325699040201530618297478399631398911", "299046539405841758619786188725324980605", "149164128577065074663806298752330135910", "39896417751151018977369607813445909083", "147290932525700798576534658043007295680", "213612540297768027605125040485755842497", "143296497971704935600314405063123807833" ] }, "id": "ASB-A-204584366-1806415e", "source": "https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java" }, "signature_type": "Line" }, { "digest": { "length": 97.0, "function_hash": "185997965583041455618509918117696796341" }, "id": "ASB-A-204584366-442de16b", "source": "https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbDeviceConnection.java", "function": "close" }, "signature_type": "Function" }, { "digest": { "length": 662.0, "function_hash": "182463343494303999816554965884778220659" }, "id": "ASB-A-204584366-60de6a61", "source": "https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java", "function": "queue" }, "signature_type": "Function" }, { "digest": { "length": 227.0, "function_hash": "289558269005376821094417639689604636205" }, "id": "ASB-A-204584366-7b4a02cc", "source": "https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbDeviceConnection.java", "function": "open" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "225644584700868056746365473993952264490", "225516317010957764561976472294732353750", "227002822758297823208964377151056791644", "38391849955678741051553217843086002921", "281439387168020840234618194339149136273", "57293824981797575096545126602507004703", "76621587704719703869209188865501611282", "108074959398907256904588025506263625319", "320966007503038203040299508750587661126", "307199871166993780345791415484723637514", "103948057965550373630226303080849526667", "233253399359387248716780084594558982699", "189212928265885170423237988826636027541", "8866131415284696403577041526688952594", "23860540723638293489521692781539987863", "249794751009769692010176244246866896178", "130247754382031353055193230757160205950", "38016763904969071085606916886336715130" ] }, "id": "ASB-A-204584366-c2bb47ac", "source": "https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbDeviceConnection.java" }, "signature_type": "Line" }, { "digest": { "length": 1213.0, "function_hash": "86870526570453178001716111580367832614" }, "id": "ASB-A-204584366-cb8263f3", "source": "https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java", "function": "queue" }, "signature_type": "Function" } ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252" ], "spl": "2023-01-01", "severity": "High", "types": [ "EoP" ] }
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "302643519188408407467161845134839330253", "33816863794465726010140598486210879433", "336806779166451494666962633279435806148" ] }, "id": "ASB-A-204584366-10eb0cce", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbDeviceConnection.java" }, "signature_type": "Line" }, { "digest": { "length": 662.0, "function_hash": "182463343494303999816554965884778220659" }, "id": "ASB-A-204584366-67ea4dc1", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java", "function": "queue" }, "signature_type": "Function" }, { "digest": { "length": 1213.0, "function_hash": "86870526570453178001716111580367832614" }, "id": "ASB-A-204584366-6c8090b8", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java", "function": "queue" }, "signature_type": "Function" }, { "digest": { "length": 137.0, "function_hash": "7269847508204790583515434263233829328" }, "id": "ASB-A-204584366-6eb28f6e", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java", "function": "close" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "276104590878752660397844813354367309942", "172353618839433354333431412538164318901", "95659188306839718572831588354300332447", "81174342330019458445585225794288420398", "83413780435536255958580647457844443009", "293719345425021902667665909660676045871", "130247754382031353055193230757160205950", "152408938682014877718961330328601492680", "162884205329918340703727952116933440069", "330292456763100805398861730204970328556", "79502387876862938617658865185021275675", "284502899353952226313921425102556205516", "123811250654480706403060173047200929721", "134860343233762423206591019317333971400", "6153809002853348190614076489219735788", "215798567649815907614467130438533073310", "76626048380436355668606965215724175700", "139727142540396795720220278206414238800", "158028791905717405744513745681220166310", "315864079412228123039281842188659089958", "258325699040201530618297478399631398911", "299046539405841758619786188725324980605", "149164128577065074663806298752330135910", "134328666961719536294798562605586728543", "21266180863328470844807282855264723075", "112452450735683852656670016861322480009", "121375302352819018791904056330244634324", "244952796154726862282007997045077708923", "289577562630712681995631442790426893809", "218105067570722703058579066673198055589", "238066504475044629330268558432848339028", "283390287968524347205917300649824936514", "304494702597116108711586962432350718927" ] }, "id": "ASB-A-204584366-b57651ec", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java" }, "signature_type": "Line" }, { "digest": { "length": 248.0, "function_hash": "294142877403536958019402403444753907027" }, "id": "ASB-A-204584366-e0608a58", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java", "function": "cancelIfOpen" }, "signature_type": "Function" }, { "digest": { "length": 109.0, "function_hash": "117374267462614018117015717487749567724" }, "id": "ASB-A-204584366-f6c48b48", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java", "function": "cancel" }, "signature_type": "Function" } ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061" ], "spl": "2023-01-01", "severity": "High", "types": [ "EoP" ] }
{ "vanir_signatures": [ { "digest": { "length": 1213.0, "function_hash": "86870526570453178001716111580367832614" }, "id": "ASB-A-204584366-364dc1b9", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java", "function": "queue" }, "signature_type": "Function" }, { "digest": { "length": 662.0, "function_hash": "182463343494303999816554965884778220659" }, "id": "ASB-A-204584366-4b15cf69", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java", "function": "queue" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "302643519188408407467161845134839330253", "33816863794465726010140598486210879433", "336806779166451494666962633279435806148" ] }, "id": "ASB-A-204584366-4b837539", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbDeviceConnection.java" }, "signature_type": "Line" }, { "digest": { "length": 248.0, "function_hash": "294142877403536958019402403444753907027" }, "id": "ASB-A-204584366-a92b8e1c", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java", "function": "cancelIfOpen" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "276104590878752660397844813354367309942", "172353618839433354333431412538164318901", "95659188306839718572831588354300332447", "81174342330019458445585225794288420398", "83413780435536255958580647457844443009", "293719345425021902667665909660676045871", "130247754382031353055193230757160205950", "152408938682014877718961330328601492680", "162884205329918340703727952116933440069", "330292456763100805398861730204970328556", "79502387876862938617658865185021275675", "284502899353952226313921425102556205516", "123811250654480706403060173047200929721", "134860343233762423206591019317333971400", "6153809002853348190614076489219735788", "215798567649815907614467130438533073310", "76626048380436355668606965215724175700", "139727142540396795720220278206414238800", "158028791905717405744513745681220166310", "315864079412228123039281842188659089958", "258325699040201530618297478399631398911", "299046539405841758619786188725324980605", "149164128577065074663806298752330135910", "134328666961719536294798562605586728543", "21266180863328470844807282855264723075", "112452450735683852656670016861322480009", "121375302352819018791904056330244634324", "244952796154726862282007997045077708923", "289577562630712681995631442790426893809", "218105067570722703058579066673198055589", "238066504475044629330268558432848339028", "283390287968524347205917300649824936514", "304494702597116108711586962432350718927" ] }, "id": "ASB-A-204584366-ce1d5bed", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java" }, "signature_type": "Line" }, { "digest": { "length": 137.0, "function_hash": "7269847508204790583515434263233829328" }, "id": "ASB-A-204584366-cf41299c", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java", "function": "close" }, "signature_type": "Function" }, { "digest": { "length": 109.0, "function_hash": "117374267462614018117015717487749567724" }, "id": "ASB-A-204584366-eb390c2a", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java", "function": "cancel" }, "signature_type": "Function" } ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061" ], "spl": "2023-01-01", "severity": "High", "types": [ "EoP" ] }
{ "vanir_signatures": [ { "digest": { "length": 137.0, "function_hash": "7269847508204790583515434263233829328" }, "id": "ASB-A-204584366-000e65ed", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java", "function": "close" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "302643519188408407467161845134839330253", "33816863794465726010140598486210879433", "336806779166451494666962633279435806148" ] }, "id": "ASB-A-204584366-32177294", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbDeviceConnection.java" }, "signature_type": "Line" }, { "digest": { "length": 109.0, "function_hash": "117374267462614018117015717487749567724" }, "id": "ASB-A-204584366-490dfeeb", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java", "function": "cancel" }, "signature_type": "Function" }, { "digest": { "length": 248.0, "function_hash": "294142877403536958019402403444753907027" }, "id": "ASB-A-204584366-a126e721", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java", "function": "cancelIfOpen" }, "signature_type": "Function" }, { "digest": { "length": 662.0, "function_hash": "182463343494303999816554965884778220659" }, "id": "ASB-A-204584366-d164fc3a", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java", "function": "queue" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "276104590878752660397844813354367309942", "172353618839433354333431412538164318901", "95659188306839718572831588354300332447", "81174342330019458445585225794288420398", "83413780435536255958580647457844443009", "293719345425021902667665909660676045871", "130247754382031353055193230757160205950", "152408938682014877718961330328601492680", "162884205329918340703727952116933440069", "330292456763100805398861730204970328556", "79502387876862938617658865185021275675", "284502899353952226313921425102556205516", "123811250654480706403060173047200929721", "134860343233762423206591019317333971400", "6153809002853348190614076489219735788", "215798567649815907614467130438533073310", "76626048380436355668606965215724175700", "139727142540396795720220278206414238800", "158028791905717405744513745681220166310", "315864079412228123039281842188659089958", "258325699040201530618297478399631398911", "299046539405841758619786188725324980605", "149164128577065074663806298752330135910", "134328666961719536294798562605586728543", "21266180863328470844807282855264723075", "112452450735683852656670016861322480009", "121375302352819018791904056330244634324", "244952796154726862282007997045077708923", "289577562630712681995631442790426893809", "218105067570722703058579066673198055589", "238066504475044629330268558432848339028", "283390287968524347205917300649824936514", "304494702597116108711586962432350718927" ] }, "id": "ASB-A-204584366-fc5b6a04", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java" }, "signature_type": "Line" }, { "digest": { "length": 1213.0, "function_hash": "86870526570453178001716111580367832614" }, "id": "ASB-A-204584366-fe529ce6", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java", "function": "queue" }, "signature_type": "Function" } ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061" ], "spl": "2023-01-01", "severity": "High", "types": [ "EoP" ] }
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "302643519188408407467161845134839330253", "33816863794465726010140598486210879433", "336806779166451494666962633279435806148" ] }, "id": "ASB-A-204584366-060ec929", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbDeviceConnection.java" }, "signature_type": "Line" }, { "digest": { "length": 109.0, "function_hash": "117374267462614018117015717487749567724" }, "id": "ASB-A-204584366-499f09d4", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java", "function": "cancel" }, "signature_type": "Function" }, { "digest": { "length": 1213.0, "function_hash": "86870526570453178001716111580367832614" }, "id": "ASB-A-204584366-6b9a33f2", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java", "function": "queue" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "276104590878752660397844813354367309942", "172353618839433354333431412538164318901", "95659188306839718572831588354300332447", "81174342330019458445585225794288420398", "83413780435536255958580647457844443009", "293719345425021902667665909660676045871", "130247754382031353055193230757160205950", "152408938682014877718961330328601492680", "162884205329918340703727952116933440069", "330292456763100805398861730204970328556", "79502387876862938617658865185021275675", "284502899353952226313921425102556205516", "123811250654480706403060173047200929721", "134860343233762423206591019317333971400", "6153809002853348190614076489219735788", "215798567649815907614467130438533073310", "76626048380436355668606965215724175700", "139727142540396795720220278206414238800", "158028791905717405744513745681220166310", "315864079412228123039281842188659089958", "258325699040201530618297478399631398911", "299046539405841758619786188725324980605", "149164128577065074663806298752330135910", "134328666961719536294798562605586728543", "21266180863328470844807282855264723075", "112452450735683852656670016861322480009", "121375302352819018791904056330244634324", "244952796154726862282007997045077708923", "289577562630712681995631442790426893809", "218105067570722703058579066673198055589", "238066504475044629330268558432848339028", "283390287968524347205917300649824936514", "304494702597116108711586962432350718927" ] }, "id": "ASB-A-204584366-7cc03009", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java" }, "signature_type": "Line" }, { "digest": { "length": 137.0, "function_hash": "7269847508204790583515434263233829328" }, "id": "ASB-A-204584366-bbb8789e", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java", "function": "close" }, "signature_type": "Function" }, { "digest": { "length": 248.0, "function_hash": "294142877403536958019402403444753907027" }, "id": "ASB-A-204584366-c35ff623", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java", "function": "cancelIfOpen" }, "signature_type": "Function" }, { "digest": { "length": 662.0, "function_hash": "182463343494303999816554965884778220659" }, "id": "ASB-A-204584366-ee1d999e", "source": "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/hardware/usb/UsbRequest.java", "function": "queue" }, "signature_type": "Function" } ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061" ], "spl": "2023-01-01", "severity": "High", "types": [ "EoP" ] }