{"id":"ASB-A-168211968", "published":"2021-01-01T00:00:00Z", "modified":"2026-04-29T15:10:00.007170452Z", "aliases":["CVE-2021-0318", "A-168211968"], "details":"In appendEventsToCacheLocked of SensorEventConnection.cpp, there is a possible out of bounds write due to a use-after-free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/native", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"8.1:0"}, {"fixed":"8.1:2021-01-01"}]}], "versions":["8.1"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b"], "severity":"High", "spl":"2021-01-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["202368162637071165403492011988823194783", "121104729448867220595608183493770835687", "293483056608763997962834505626895548119", "142822261472916088772458385887388879543", "54688159848720015509561153431329904789", "4277870523749451347662473076295229414", "300306834319706072564686893329399314156", "288508651323435783821469633011772846326", "278248246036607606048281863112930083024", "226599680908214427281814260888099075190", "67674543247936684167742947757204455558", "151215926628002863242663729258108071898", "15069736780096551286450254408379903251", "89204402314811274667127098496563295789", "118836781511721118979551795024603328147", "48624523166459769892248248668580047688", "61120592048590206267109638804359711989", "20894016542014276904274705222809748103", "160387362135192214326949618991660477992", "302123035189751588749838170976561479386", "207251469058233223588979060847798748666", "260197688206117516574268416906806434397", "270188350052514123047402395743758234257", "55970111288830492236382369679935355198", "43937621687462578598029918613112041832"], "threshold":0.9}, "id":"ASB-A-168211968-4b6f40e8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.cpp"}}, {"deprecated":false, "digest":{"function_hash":"33931799434306739723823299059545368450", "length":318}, "id":"ASB-A-168211968-62f2b0e7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.cpp", "function":"SensorService::SensorEventConnection::enableDisable"}}, {"deprecated":false, "digest":{"function_hash":"137297107811361477517210085125065757025", "length":170}, "id":"ASB-A-168211968-90c6ba15", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.cpp", "function":"SensorService::SensorEventConnection::setEventRate"}}, {"deprecated":false, "digest":{"function_hash":"225963280910332089164664548448213960643", "length":243}, "id":"ASB-A-168211968-baf98c7d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.cpp", "function":"SensorService::SensorEventConnection::destroy"}}, {"deprecated":false, "digest":{"function_hash":"125560433277978335678868205680761343141", "length":158}, "id":"ASB-A-168211968-c58b8bc2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.cpp", "function":"SensorService::SensorEventConnection::~SensorEventConnection"}}, {"deprecated":false, "digest":{"function_hash":"169200356894306624094865171954097805256", "length":120}, "id":"ASB-A-168211968-c98dc41f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.cpp", "function":"SensorService::SensorEventConnection::flush"}}, {"deprecated":false, "digest":{"line_hashes":["122281379492002828810663692672006764002", "171645295499317909613465543532018460138", "176544860176600423777909228970737669623", "254183565615526321487899148978979568729", "928524509260589180792834089856723854", "68702381720170381707297165040800976011"], "threshold":0.9}, "id":"ASB-A-168211968-ccdd5905", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.h"}}]}}, {"package":{"name":"platform/frameworks/native", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"9:0"}, {"fixed":"9:2021-01-01"}]}], "versions":["9"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b"], "severity":"High", "spl":"2021-01-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"125560433277978335678868205680761343141", "length":158}, "id":"ASB-A-168211968-47586f18", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.cpp", "function":"SensorService::SensorEventConnection::~SensorEventConnection"}}, {"deprecated":false, "digest":{"function_hash":"225963280910332089164664548448213960643", "length":243}, "id":"ASB-A-168211968-721ac9b3", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.cpp", "function":"SensorService::SensorEventConnection::destroy"}}, {"deprecated":false, "digest":{"line_hashes":["202368162637071165403492011988823194783", "121104729448867220595608183493770835687", "293483056608763997962834505626895548119", "142822261472916088772458385887388879543", "54688159848720015509561153431329904789", "4277870523749451347662473076295229414", "300306834319706072564686893329399314156", "288508651323435783821469633011772846326", "278248246036607606048281863112930083024", "226599680908214427281814260888099075190", "67674543247936684167742947757204455558", "151215926628002863242663729258108071898", "15069736780096551286450254408379903251", "89204402314811274667127098496563295789", "118836781511721118979551795024603328147", "48624523166459769892248248668580047688", "61120592048590206267109638804359711989", "20894016542014276904274705222809748103", "160387362135192214326949618991660477992", "302123035189751588749838170976561479386", "207251469058233223588979060847798748666", "260197688206117516574268416906806434397", "270188350052514123047402395743758234257", "55970111288830492236382369679935355198", "43937621687462578598029918613112041832"], "threshold":0.9}, "id":"ASB-A-168211968-846c4cee", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.cpp"}}, {"deprecated":false, "digest":{"function_hash":"169200356894306624094865171954097805256", "length":120}, "id":"ASB-A-168211968-9f300c16", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.cpp", "function":"SensorService::SensorEventConnection::flush"}}, {"deprecated":false, "digest":{"line_hashes":["122281379492002828810663692672006764002", "171645295499317909613465543532018460138", "176544860176600423777909228970737669623", "254183565615526321487899148978979568729", "928524509260589180792834089856723854", "68702381720170381707297165040800976011"], "threshold":0.9}, "id":"ASB-A-168211968-aa30693f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.h"}}, {"deprecated":false, "digest":{"function_hash":"137297107811361477517210085125065757025", "length":170}, "id":"ASB-A-168211968-ce35a513", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.cpp", "function":"SensorService::SensorEventConnection::setEventRate"}}, {"deprecated":false, "digest":{"function_hash":"33931799434306739723823299059545368450", "length":318}, "id":"ASB-A-168211968-e9813f10", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.cpp", "function":"SensorService::SensorEventConnection::enableDisable"}}]}}, {"package":{"name":"platform/frameworks/native", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"10:0"}, {"fixed":"10:2021-01-01"}]}], "versions":["10"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b"], "severity":"High", "spl":"2021-01-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"169200356894306624094865171954097805256", "length":120}, "id":"ASB-A-168211968-0023f1b5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.cpp", "function":"SensorService::SensorEventConnection::flush"}}, {"deprecated":false, "digest":{"function_hash":"125560433277978335678868205680761343141", "length":158}, "id":"ASB-A-168211968-02e25bc4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.cpp", "function":"SensorService::SensorEventConnection::~SensorEventConnection"}}, {"deprecated":false, "digest":{"function_hash":"33931799434306739723823299059545368450", "length":318}, "id":"ASB-A-168211968-2d80f79e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.cpp", "function":"SensorService::SensorEventConnection::enableDisable"}}, {"deprecated":false, "digest":{"function_hash":"225963280910332089164664548448213960643", "length":243}, "id":"ASB-A-168211968-7baf05ec", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.cpp", "function":"SensorService::SensorEventConnection::destroy"}}, {"deprecated":false, "digest":{"function_hash":"137297107811361477517210085125065757025", "length":170}, "id":"ASB-A-168211968-855f879c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.cpp", "function":"SensorService::SensorEventConnection::setEventRate"}}, {"deprecated":false, "digest":{"line_hashes":["122281379492002828810663692672006764002", "171645295499317909613465543532018460138", "176544860176600423777909228970737669623", "254183565615526321487899148978979568729", "928524509260589180792834089856723854", "68702381720170381707297165040800976011"], "threshold":0.9}, "id":"ASB-A-168211968-8c46c682", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.h"}}, {"deprecated":false, "digest":{"line_hashes":["202368162637071165403492011988823194783", "121104729448867220595608183493770835687", "293483056608763997962834505626895548119", "142822261472916088772458385887388879543", "54688159848720015509561153431329904789", "4277870523749451347662473076295229414", "300306834319706072564686893329399314156", "288508651323435783821469633011772846326", "278248246036607606048281863112930083024", "226599680908214427281814260888099075190", "67674543247936684167742947757204455558", "151215926628002863242663729258108071898", "15069736780096551286450254408379903251", "89204402314811274667127098496563295789", "118836781511721118979551795024603328147", "48624523166459769892248248668580047688", "61120592048590206267109638804359711989", "20894016542014276904274705222809748103", "160387362135192214326949618991660477992", "302123035189751588749838170976561479386", "207251469058233223588979060847798748666", "260197688206117516574268416906806434397", "270188350052514123047402395743758234257", "55970111288830492236382369679935355198", "43937621687462578598029918613112041832"], "threshold":0.9}, "id":"ASB-A-168211968-97aae3e9", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.cpp"}}]}}, {"package":{"name":"platform/frameworks/native", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"11:0"}, {"fixed":"11:2021-01-01"}]}], "versions":["11"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b"], "severity":"High", "spl":"2021-01-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["122281379492002828810663692672006764002", "171645295499317909613465543532018460138", "176544860176600423777909228970737669623", "254183565615526321487899148978979568729", "928524509260589180792834089856723854", "68702381720170381707297165040800976011"], "threshold":0.9}, "id":"ASB-A-168211968-2edb8018", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.h"}}, {"deprecated":false, "digest":{"function_hash":"137297107811361477517210085125065757025", "length":170}, "id":"ASB-A-168211968-31b2d87b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.cpp", "function":"SensorService::SensorEventConnection::setEventRate"}}, {"deprecated":false, "digest":{"function_hash":"125560433277978335678868205680761343141", "length":158}, "id":"ASB-A-168211968-3b471301", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.cpp", "function":"SensorService::SensorEventConnection::~SensorEventConnection"}}, {"deprecated":false, "digest":{"line_hashes":["202368162637071165403492011988823194783", "121104729448867220595608183493770835687", "293483056608763997962834505626895548119", "142822261472916088772458385887388879543", "54688159848720015509561153431329904789", "4277870523749451347662473076295229414", "300306834319706072564686893329399314156", "288508651323435783821469633011772846326", "278248246036607606048281863112930083024", "226599680908214427281814260888099075190", "67674543247936684167742947757204455558", "151215926628002863242663729258108071898", "15069736780096551286450254408379903251", "89204402314811274667127098496563295789", "118836781511721118979551795024603328147", "48624523166459769892248248668580047688", "61120592048590206267109638804359711989", "20894016542014276904274705222809748103", "160387362135192214326949618991660477992", "302123035189751588749838170976561479386", "207251469058233223588979060847798748666", "260197688206117516574268416906806434397", "270188350052514123047402395743758234257", "55970111288830492236382369679935355198", "43937621687462578598029918613112041832"], "threshold":0.9}, "id":"ASB-A-168211968-8567af1e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.cpp"}}, {"deprecated":false, "digest":{"function_hash":"225963280910332089164664548448213960643", "length":243}, "id":"ASB-A-168211968-9746f222", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.cpp", "function":"SensorService::SensorEventConnection::destroy"}}, {"deprecated":false, "digest":{"function_hash":"33931799434306739723823299059545368450", "length":318}, "id":"ASB-A-168211968-a3e80b35", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.cpp", "function":"SensorService::SensorEventConnection::enableDisable"}}, {"deprecated":false, "digest":{"function_hash":"169200356894306624094865171954097805256", "length":120}, "id":"ASB-A-168211968-d0fc6c94", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b", "target":{"file":"services/sensorservice/SensorEventConnection.cpp", "function":"SensorService::SensorEventConnection::flush"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2021-01-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b"}]}