ASB-A-243362981

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-243362981.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-243362981
Aliases
  • A-243362981
  • CVE-2023-20939
Published
2023-02-01T00:00:00Z
Modified
2024-08-07T19:30:15.951237Z
Summary
Crash in/system/bin/wificond, HWAddressSanitizer: tag-mismatch on address 0x003856ed0b24 at pc 0x0077686e55a0 WRITE of size 4 at 0x003856ed0b24 tags: 21/4c (ptr/mem) in thread T0
Details

In multiple functions of looperbackedevent_loop.cpp, there is a possible way to corrupt memory due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/system/connectivity/wificond

Package

Name
platform/system/connectivity/wificond

Affected ranges

Type
ECOSYSTEM
Events
Introduced
12:0
Fixed
12:2023-02-01

Affected versions

Other

12

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "319327535018563556537300619132357203352",
                    "17999300148438267301587355388994997822",
                    "306879720608399222000438574532273225381",
                    "108460143985267635697560081242897765717",
                    "47479131463942207073837147878800670514",
                    "91236466443986010974016562541256132573",
                    "40952505575044049327392086311685666435",
                    "183542082121842634020895745373219636274",
                    "72481930177212987020019770101385593031",
                    "307739422484241164954545676323133249978",
                    "93647322595107672473061259369585552911",
                    "237612482315895765008086015596871373212",
                    "187592753822623485824279067848869789625",
                    "270715323998066927257979354458094253841",
                    "121768234032291930514744645347766483640",
                    "147316941013154811716422241642034045900"
                ]
            },
            "id": "ASB-A-243362981-65513374",
            "source": "https://android.googlesource.com/platform/system/connectivity/wificond/+/a9de1657e9915a2d47fb87a3f55ac97157ad53b6",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "looper_backed_event_loop.cpp"
            },
            "signature_type": "Line"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/system/connectivity/wificond/+/a9de1657e9915a2d47fb87a3f55ac97157ad53b6"
    ],
    "spl": "2023-02-01",
    "severity": "High",
    "types": [
        "EoP"
    ]
}

Android / platform/system/connectivity/wificond

Package

Name
platform/system/connectivity/wificond

Affected ranges

Type
ECOSYSTEM
Events
Introduced
12L:0
Fixed
12L:2023-02-01

Affected versions

Other

12L

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "319327535018563556537300619132357203352",
                    "17999300148438267301587355388994997822",
                    "306879720608399222000438574532273225381",
                    "108460143985267635697560081242897765717",
                    "47479131463942207073837147878800670514",
                    "91236466443986010974016562541256132573",
                    "40952505575044049327392086311685666435",
                    "183542082121842634020895745373219636274",
                    "72481930177212987020019770101385593031",
                    "307739422484241164954545676323133249978",
                    "93647322595107672473061259369585552911",
                    "237612482315895765008086015596871373212",
                    "187592753822623485824279067848869789625",
                    "270715323998066927257979354458094253841",
                    "121768234032291930514744645347766483640",
                    "147316941013154811716422241642034045900"
                ]
            },
            "id": "ASB-A-243362981-a40d2f7d",
            "source": "https://android.googlesource.com/platform/system/connectivity/wificond/+/f43bf30eadb6c423e9748a69479fa146a196e8dc",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "looper_backed_event_loop.cpp"
            },
            "signature_type": "Line"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/system/connectivity/wificond/+/f43bf30eadb6c423e9748a69479fa146a196e8dc"
    ],
    "spl": "2023-02-01",
    "severity": "High",
    "types": [
        "EoP"
    ]
}

Android / platform/system/connectivity/wificond

Package

Name
platform/system/connectivity/wificond

Affected ranges

Type
ECOSYSTEM
Events
Introduced
13:0
Fixed
13:2023-02-01

Affected versions

Other

13

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "319327535018563556537300619132357203352",
                    "17999300148438267301587355388994997822",
                    "306879720608399222000438574532273225381",
                    "108460143985267635697560081242897765717",
                    "47479131463942207073837147878800670514",
                    "91236466443986010974016562541256132573",
                    "231687596611044883303053317069486143984",
                    "256345738579418720570831858151960272017",
                    "190379933020435969839673579103666204962",
                    "242524073966062844225675598012649427056",
                    "93647322595107672473061259369585552911",
                    "237612482315895765008086015596871373212",
                    "204399469402561494830585794807320834393",
                    "319444232589160658979659192150897816963",
                    "183696515813962808202524282340802979573",
                    "57237081120627105187066569127807783311"
                ]
            },
            "id": "ASB-A-243362981-a5f8b24e",
            "source": "https://android.googlesource.com/platform/system/connectivity/wificond/+/73bb787e6e780a0dd15c0d3d03efaf5dfc270e26",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "looper_backed_event_loop.cpp"
            },
            "signature_type": "Line"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/system/connectivity/wificond/+/73bb787e6e780a0dd15c0d3d03efaf5dfc270e26"
    ],
    "spl": "2023-02-01",
    "severity": "High",
    "types": [
        "EoP"
    ]
}