{"id":"ASB-A-176919394", "published":"2021-03-01T00:00:00Z", "modified":"2026-07-09T15:25:53.339171538Z", "aliases":["CVE-2021-0399", "A-176919394"], "details":"In qtaguid_untag of xt_qtaguid.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":":linux_kernel:", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":":0"}, {"fixed":":2021-03-05"}]}], "versions":["Kernel"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/c2ab93b45b5cdc426868fb8793ada2cac20568ef", "https://android.googlesource.com/kernel/common/+/df8ce9235e1d1e7d46904bfdbf715aa2c62c0b7e", "https://android.googlesource.com/kernel/common/+/964d3c5a33b1f899a79f55741f9660b7ed2e9c83", "https://android.googlesource.com/kernel/common/+/3bb3f19d2f63a4c559645abef673a7ca25b149b7", "https://android.googlesource.com/kernel/common/+/8f9138d6c464a60f37f1b293bc61ccbcce6210f6", "https://android.googlesource.com/kernel/common/+/9290e39a55a98d1788f4d532333bd58b1acf0e10", "https://android.googlesource.com/kernel/common/+/b89f039e8218beb29c06bb7e957c4eb57bbcdecc", "https://android.googlesource.com/kernel/common/+/2bd81ced0685922df12f4be3338ea632805624e9"], "severity":"High", "spl":"2021-03-05", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["92360495398636792176406546966757924225", "102855977441865370861986259867660240207", "31282538023324945392025687370956578747", "239699027772273096232575130703797632606", "268465686708601018015124414172962347656", "205144268850783558068278548897086870471", "59594931387502679787218910298327066007", "251433835701724304572176599635525977821", "254847197982937906578928464289878670754", "163364177549421917427061029309898663933", "290098872090137009112042818356296424907"], "threshold":0.9}, "id":"ASB-A-176919394-01057f18", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/df8ce9235e1d1e7d46904bfdbf715aa2c62c0b7e", "target":{"file":"net/netfilter/xt_qtaguid.c"}}, {"deprecated":false, "digest":{"line_hashes":["92360495398636792176406546966757924225", "102855977441865370861986259867660240207", "31282538023324945392025687370956578747", "239699027772273096232575130703797632606", "268465686708601018015124414172962347656", "205144268850783558068278548897086870471", "59594931387502679787218910298327066007", "251433835701724304572176599635525977821", "254847197982937906578928464289878670754", "163364177549421917427061029309898663933", "290098872090137009112042818356296424907"], "threshold":0.9}, "id":"ASB-A-176919394-038482b0", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/8f9138d6c464a60f37f1b293bc61ccbcce6210f6", "target":{"file":"net/netfilter/xt_qtaguid.c"}}, {"deprecated":false, "digest":{"line_hashes":["92360495398636792176406546966757924225", "102855977441865370861986259867660240207", "31282538023324945392025687370956578747", "239699027772273096232575130703797632606", "268465686708601018015124414172962347656", "205144268850783558068278548897086870471", "59594931387502679787218910298327066007", "251433835701724304572176599635525977821", "254847197982937906578928464289878670754", "163364177549421917427061029309898663933", "290098872090137009112042818356296424907"], "threshold":0.9}, "id":"ASB-A-176919394-1bf4526e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/b89f039e8218beb29c06bb7e957c4eb57bbcdecc", "target":{"file":"net/netfilter/xt_qtaguid.c"}}, {"deprecated":false, "digest":{"function_hash":"296515043061779446035691564728054954367", "length":1221}, "id":"ASB-A-176919394-1f004dab", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/c2ab93b45b5cdc426868fb8793ada2cac20568ef", "target":{"file":"net/netfilter/xt_qtaguid.c", "function":"qtaguid_untag"}}, {"deprecated":false, "digest":{"line_hashes":["92360495398636792176406546966757924225", "102855977441865370861986259867660240207", "31282538023324945392025687370956578747", "239699027772273096232575130703797632606", "268465686708601018015124414172962347656", "205144268850783558068278548897086870471", "59594931387502679787218910298327066007", "251433835701724304572176599635525977821", "254847197982937906578928464289878670754", "163364177549421917427061029309898663933", "290098872090137009112042818356296424907"], "threshold":0.9}, "id":"ASB-A-176919394-266766dd", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/964d3c5a33b1f899a79f55741f9660b7ed2e9c83", "target":{"file":"net/netfilter/xt_qtaguid.c"}}, {"deprecated":false, "digest":{"function_hash":"296515043061779446035691564728054954367", "length":1221}, "id":"ASB-A-176919394-3700358f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/8f9138d6c464a60f37f1b293bc61ccbcce6210f6", "target":{"file":"net/netfilter/xt_qtaguid.c", "function":"qtaguid_untag"}}, {"deprecated":false, "digest":{"line_hashes":["92360495398636792176406546966757924225", "102855977441865370861986259867660240207", "31282538023324945392025687370956578747", "239699027772273096232575130703797632606", "268465686708601018015124414172962347656", "205144268850783558068278548897086870471", "59594931387502679787218910298327066007", "251433835701724304572176599635525977821", "254847197982937906578928464289878670754", "163364177549421917427061029309898663933", "290098872090137009112042818356296424907"], "threshold":0.9}, "id":"ASB-A-176919394-5c3c8695", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/9290e39a55a98d1788f4d532333bd58b1acf0e10", "target":{"file":"net/netfilter/xt_qtaguid.c"}}, {"deprecated":false, "digest":{"function_hash":"296515043061779446035691564728054954367", "length":1221}, "id":"ASB-A-176919394-6d273b96", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/2bd81ced0685922df12f4be3338ea632805624e9", "target":{"file":"net/netfilter/xt_qtaguid.c", "function":"qtaguid_untag"}}, {"deprecated":false, "digest":{"line_hashes":["92360495398636792176406546966757924225", "102855977441865370861986259867660240207", "31282538023324945392025687370956578747", "239699027772273096232575130703797632606", "268465686708601018015124414172962347656", "205144268850783558068278548897086870471", "59594931387502679787218910298327066007", "251433835701724304572176599635525977821", "254847197982937906578928464289878670754", "163364177549421917427061029309898663933", "290098872090137009112042818356296424907"], "threshold":0.9}, "id":"ASB-A-176919394-933d1983", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/c2ab93b45b5cdc426868fb8793ada2cac20568ef", "target":{"file":"net/netfilter/xt_qtaguid.c"}}, {"deprecated":false, "digest":{"function_hash":"296515043061779446035691564728054954367", "length":1221}, "id":"ASB-A-176919394-9a699e3b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/df8ce9235e1d1e7d46904bfdbf715aa2c62c0b7e", "target":{"file":"net/netfilter/xt_qtaguid.c", "function":"qtaguid_untag"}}, {"deprecated":false, "digest":{"function_hash":"296515043061779446035691564728054954367", "length":1221}, "id":"ASB-A-176919394-a03ea69b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/964d3c5a33b1f899a79f55741f9660b7ed2e9c83", "target":{"file":"net/netfilter/xt_qtaguid.c", "function":"qtaguid_untag"}}, {"deprecated":false, "digest":{"line_hashes":["92360495398636792176406546966757924225", "102855977441865370861986259867660240207", "31282538023324945392025687370956578747", "239699027772273096232575130703797632606", "268465686708601018015124414172962347656", "205144268850783558068278548897086870471", "59594931387502679787218910298327066007", "251433835701724304572176599635525977821", "254847197982937906578928464289878670754", "163364177549421917427061029309898663933", "290098872090137009112042818356296424907"], "threshold":0.9}, "id":"ASB-A-176919394-b0551564", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/3bb3f19d2f63a4c559645abef673a7ca25b149b7", "target":{"file":"net/netfilter/xt_qtaguid.c"}}, {"deprecated":false, "digest":{"function_hash":"296515043061779446035691564728054954367", "length":1221}, "id":"ASB-A-176919394-bbeec7ab", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/9290e39a55a98d1788f4d532333bd58b1acf0e10", "target":{"file":"net/netfilter/xt_qtaguid.c", "function":"qtaguid_untag"}}, {"deprecated":false, "digest":{"line_hashes":["92360495398636792176406546966757924225", "102855977441865370861986259867660240207", "31282538023324945392025687370956578747", "239699027772273096232575130703797632606", "268465686708601018015124414172962347656", "205144268850783558068278548897086870471", "59594931387502679787218910298327066007", "251433835701724304572176599635525977821", "254847197982937906578928464289878670754", "163364177549421917427061029309898663933", "290098872090137009112042818356296424907"], "threshold":0.9}, "id":"ASB-A-176919394-e299c05d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/2bd81ced0685922df12f4be3338ea632805624e9", "target":{"file":"net/netfilter/xt_qtaguid.c"}}, {"deprecated":false, "digest":{"function_hash":"296515043061779446035691564728054954367", "length":1221}, "id":"ASB-A-176919394-efb35aad", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/b89f039e8218beb29c06bb7e957c4eb57bbcdecc", "target":{"file":"net/netfilter/xt_qtaguid.c", "function":"qtaguid_untag"}}, {"deprecated":false, "digest":{"function_hash":"296515043061779446035691564728054954367", "length":1221}, "id":"ASB-A-176919394-fc36d934", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/3bb3f19d2f63a4c559645abef673a7ca25b149b7", "target":{"file":"net/netfilter/xt_qtaguid.c", "function":"qtaguid_untag"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2021-03-01"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/c2ab93b45b5cdc426868fb8793ada2cac20568ef"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/df8ce9235e1d1e7d46904bfdbf715aa2c62c0b7e"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/964d3c5a33b1f899a79f55741f9660b7ed2e9c83"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/3bb3f19d2f63a4c559645abef673a7ca25b149b7"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/8f9138d6c464a60f37f1b293bc61ccbcce6210f6"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/9290e39a55a98d1788f4d532333bd58b1acf0e10"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/b89f039e8218beb29c06bb7e957c4eb57bbcdecc"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/2bd81ced0685922df12f4be3338ea632805624e9"}]}