{"id":"ASB-A-174768985", "published":"2021-04-01T00:00:00Z", "modified":"2026-07-09T15:25:53.339171538Z", "aliases":["CVE-2021-0442", "A-174768985"], "details":"In updateInfo of android_hardware_input_InputApplicationHandle.cpp, there is a possible control of code flow due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"11:0"}, {"fixed":"11:2021-04-01"}]}], "versions":["11"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9"], "severity":"High", "spl":"2021-04-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["153744076643136944585803601936704252406", "191069972467045260179571494410002778197", "202681386905527720655919683999869261721", "15958127332518746767328068968191205640", "318299242881945210416292452118564584693", "55375548146193762839776290877106867454", "202310136962832530345017029727712797741"], "threshold":0.9}, "id":"ASB-A-174768985-04caa71e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9", "target":{"file":"services/core/java/com/android/server/wm/DragState.java"}}, {"deprecated":false, "digest":{"line_hashes":["271546497008423922007134332397750106801", "135376793536561302429612198419805683377", "257683765209509567829787144032624769991", "162579258192833944394269057382934617028", "83439147027032957021504045159767500334", "37354576528130784416446125731969042512", "189483160974541279312152320671132463449", "109451405292327600871396085012624285017", "151273012959209593096603173428095289063", "90930562893205979910989518243025177110"], "threshold":0.9}, "id":"ASB-A-174768985-15566071", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9", "target":{"file":"core/java/android/view/InputApplicationHandle.java"}}, {"deprecated":false, "digest":{"line_hashes":["26957685519766614503589251201715250823", "321531819659876158111800959134030260503", "102292509821670253063205959530953119682", "127881413443537950781394393579443572909", "252141743465987673416136319460067673442", "29635728004460658695423747706617846811", "320905234923437747534973550871417416541", "108960937413202098903920995227531576931", "179811016529985193274331088371148061034", "145547028764017056133629275910941138982", "202589890298668617314104527572573528803"], "threshold":0.9}, "id":"ASB-A-174768985-20b16991", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9", "target":{"file":"services/core/java/com/android/server/wm/ActivityRecord.java"}}, {"deprecated":false, "digest":{"line_hashes":["171337628856895462170428563135667480767", "175849593308080929364969470679777901591", "107640031197165006063430346673722033218", "161193235010992212944116184996842124384"], "threshold":0.9}, "id":"ASB-A-174768985-29b295ec", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9", "target":{"file":"core/java/android/view/InputWindowHandle.java"}}, {"deprecated":false, "digest":{"line_hashes":["83368269012663771016049970579209844722", "286708047613863889839923145739538902379", "223586558792224597393547820259128359624", "246955963403290088873544787201627998369", "331394319946452497981790835407920437345", "44618377489504844624472829319631502855", "174358142572029452316023607642450521601", "15540230614059821618049035737051309569", "296341302774128398263045739389654295151", "250022653165885384938581463379527764361", "8129687793026399158356652003959754672", "134175639946818297988967965025965143791", "308553176132704873761358313074362008004", "330502945947621550835230208288804183704", "114603130514586176985481021889933629272", "149308747222860460561536587935144377939", "310189140216267090555336510730476793184", "163853490069869190901724122294504165010", "317049367158872872197623055599075618926"], "threshold":0.9}, "id":"ASB-A-174768985-2b2e1131", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9", "target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java"}}, {"deprecated":false, "digest":{"function_hash":"132134078652155884660179338492736332241", "length":5286}, "id":"ASB-A-174768985-3f15a943", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9", "target":{"file":"services/core/java/com/android/server/wm/ActivityRecord.java", "function":"ActivityRecord"}}, {"deprecated":false, "digest":{"function_hash":"247053537370944156507000072792808381565", "length":1602}, "id":"ASB-A-174768985-42d7f274", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9", "target":{"file":"services/core/java/com/android/server/wm/InputConsumerImpl.java", "function":"InputConsumerImpl"}}, {"deprecated":false, "digest":{"function_hash":"78330140433301931354312180114754379654", "length":683}, "id":"ASB-A-174768985-4a31c1cf", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9", "target":{"file":"core/jni/android_hardware_input_InputApplicationHandle.cpp", "function":"NativeInputApplicationHandle::updateInfo"}}, {"deprecated":false, "digest":{"function_hash":"216190859915552726671707505792069809036", "length":51}, "id":"ASB-A-174768985-4b3cfaf4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9", "target":{"file":"core/java/android/view/InputApplicationHandle.java", "function":"InputApplicationHandle"}}, {"deprecated":false, "digest":{"function_hash":"108642266354670242015681993626743599789", "length":2649}, "id":"ASB-A-174768985-533b0dcb", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9", "target":{"file":"services/core/java/com/android/server/wm/TaskPositioner.java", "function":"register"}}, {"deprecated":false, "digest":{"function_hash":"142534661548562157915207785493089768884", "length":347}, "id":"ASB-A-174768985-6697982b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9", "target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java", "function":"setFocusedAppLw"}}, {"deprecated":false, "digest":{"function_hash":"15518855643381758960988747378871682625", "length":1687}, "id":"ASB-A-174768985-6ea15bcd", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9", "target":{"file":"services/core/java/com/android/server/wm/DragState.java", "function":"InputInterceptor"}}, {"deprecated":false, "digest":{"line_hashes":["201137968757774036011500386299193558621", "48373362057840241665531178653613190383", "5191521543138551507807575226648266125", "203311827832482211997432379385433077069", "127930764700712658146149619023655277721", "101947489553470850814291482442190922960", "337972922942139157860659371462974656346"], "threshold":0.9}, "id":"ASB-A-174768985-6fbe5bd2", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9", "target":{"file":"services/core/java/com/android/server/wm/TaskPositioner.java"}}, {"deprecated":false, "digest":{"function_hash":"77486036293143334442594680999603560102", "length":1397}, "id":"ASB-A-174768985-a443f5da", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9", "target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java", "function":"populateInputWindowHandle"}}, {"deprecated":false, "digest":{"line_hashes":["271420804206205498737942444950354212790", "26972480082679670746746807526704798503", "292776199800831195640098750981070917387", "198653486015484748682929179998445879170"], "threshold":0.9}, "id":"ASB-A-174768985-b3711bed", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java"}}, {"deprecated":false, "digest":{"function_hash":"218135769503400627448119552659594310412", "length":2911}, "id":"ASB-A-174768985-e983cc70", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java", "function":"WindowState"}}, {"deprecated":false, "digest":{"line_hashes":["145570212539964443255974915325890039347", "251852284830843490762201293182960991294", "299754344963634365290334342999266153945", "277509967450370874576482820226584818579"], "threshold":0.9}, "id":"ASB-A-174768985-f03a04c1", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9", "target":{"file":"core/jni/android_hardware_input_InputApplicationHandle.cpp"}}, {"deprecated":false, "digest":{"line_hashes":["175933733805455145097584040246438524843", "105461127785727044380913160268439453305", "305034128722697340549031228211472881336", "93208044332548877171188181052558065619", "215388775232037441973613713031297832777", "209699070831022211689508349717542155377", "237722352014975723671798766190927613549"], "threshold":0.9}, "id":"ASB-A-174768985-fe62b77c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9", "target":{"file":"services/core/java/com/android/server/wm/InputConsumerImpl.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2021-04-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/a5eb01054b44472d32bda00066dc6ffceb9123d1"}]}