{"id":"ASB-A-461507723", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-58956", "A-461507723"], "details":"In modpowF4 of avb_rsa.c, there is a possible signature verification bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/external/avb", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/avb/+/5262c8ef81ae5d4606da24d004bd3170308f9dcf"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["295888276594966255304195588615565650312", "43919443325846488345856449299617816396", "47918743755306585630071247991389662160", "90320165058021931767383223621283132405", "25652301680987172828517213841730144170", "186167342490246128988331065328875165621", "145079804260352517559297267693476946183", "270958262497982618998214295548258911279", "222739456146484954029573998889475780352", "334951624658366945285492077903980358926", "37001477771028326292229767023349440890", "340193210849633232090684683998124351142", "80084644866510519480419027006621445508", "102459536319354513070929098183781529195", "289794736789759278524507271740860914604", "57237917623675569214869953447193572993", "221621757692718643360303840497824853455", "179527262868024871688976240454254376896"], "threshold":0.9}, "id":"ASB-A-461507723-005b0c6c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/avb/+/5262c8ef81ae5d4606da24d004bd3170308f9dcf", "target":{"file":"libavb/avb_rsa.c"}}, {"deprecated":false, "digest":{"function_hash":"99121567533606075055862966666024805091", "length":1360}, "id":"ASB-A-461507723-9d51b375", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/avb/+/5262c8ef81ae5d4606da24d004bd3170308f9dcf", "target":{"file":"libavb/avb_rsa.c", "function":"modpowF4"}}, {"deprecated":false, "digest":{"function_hash":"69548868784106392191353185226868731472", "length":1531}, "id":"ASB-A-461507723-b077173e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/avb/+/5262c8ef81ae5d4606da24d004bd3170308f9dcf", "target":{"file":"libavb/avb_rsa.c", "function":"avb_rsa_verify"}}]}}, {"package":{"name":"platform/external/avb", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/avb/+/e85551ac83e561a8ee0a14408acf8928f2afea7d"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"59930707550007530595320650224867079192", "length":1197}, "id":"ASB-A-461507723-1636f1e7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/avb/+/e85551ac83e561a8ee0a14408acf8928f2afea7d", "target":{"file":"libavb/avb_rsa.c", "function":"avb_rsa_verify"}}, {"deprecated":false, "digest":{"function_hash":"99121567533606075055862966666024805091", "length":1360}, "id":"ASB-A-461507723-c06135e8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/avb/+/e85551ac83e561a8ee0a14408acf8928f2afea7d", "target":{"file":"libavb/avb_rsa.c", "function":"modpowF4"}}, {"deprecated":false, "digest":{"line_hashes":["295888276594966255304195588615565650312", "43919443325846488345856449299617816396", "47918743755306585630071247991389662160", "90320165058021931767383223621283132405", "25652301680987172828517213841730144170", "186167342490246128988331065328875165621", "145079804260352517559297267693476946183", "270958262497982618998214295548258911279", "222739456146484954029573998889475780352", "334951624658366945285492077903980358926", "37001477771028326292229767023349440890", "340193210849633232090684683998124351142", "237040744458659864527797877325660687507", "253166598775633115102591107008784942957", "289794736789759278524507271740860914604", "57237917623675569214869953447193572993", "221621757692718643360303840497824853455", "179527262868024871688976240454254376896"], "threshold":0.9}, "id":"ASB-A-461507723-eb0e7707", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/avb/+/e85551ac83e561a8ee0a14408acf8928f2afea7d", "target":{"file":"libavb/avb_rsa.c"}}]}}, {"package":{"name":"platform/external/avb", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/avb/+/09ae0f478a10d492a91f9355b47e57460d36bf88"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"59930707550007530595320650224867079192", "length":1197}, "id":"ASB-A-461507723-95c44735", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/avb/+/09ae0f478a10d492a91f9355b47e57460d36bf88", "target":{"file":"libavb/avb_rsa.c", "function":"avb_rsa_verify"}}, {"deprecated":false, "digest":{"function_hash":"99121567533606075055862966666024805091", "length":1360}, "id":"ASB-A-461507723-b0086948", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/avb/+/09ae0f478a10d492a91f9355b47e57460d36bf88", "target":{"file":"libavb/avb_rsa.c", "function":"modpowF4"}}, {"deprecated":false, "digest":{"line_hashes":["295888276594966255304195588615565650312", "43919443325846488345856449299617816396", "47918743755306585630071247991389662160", "90320165058021931767383223621283132405", "25652301680987172828517213841730144170", "186167342490246128988331065328875165621", "145079804260352517559297267693476946183", "270958262497982618998214295548258911279", "222739456146484954029573998889475780352", "334951624658366945285492077903980358926", "37001477771028326292229767023349440890", "340193210849633232090684683998124351142", "237040744458659864527797877325660687507", "253166598775633115102591107008784942957", "289794736789759278524507271740860914604", "57237917623675569214869953447193572993", "221621757692718643360303840497824853455", "179527262868024871688976240454254376896"], "threshold":0.9}, "id":"ASB-A-461507723-ec514cf7", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/avb/+/09ae0f478a10d492a91f9355b47e57460d36bf88", "target":{"file":"libavb/avb_rsa.c"}}]}}, {"package":{"name":"platform/external/avb", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/avb/+/d2f20a12eabce52ebef18ed02ca44c4ac97a6a4c"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"69548868784106392191353185226868731472", "length":1531}, "id":"ASB-A-461507723-60e3e5f8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/avb/+/d2f20a12eabce52ebef18ed02ca44c4ac97a6a4c", "target":{"file":"libavb/avb_rsa.c", "function":"avb_rsa_verify"}}, {"deprecated":false, "digest":{"line_hashes":["295888276594966255304195588615565650312", "43919443325846488345856449299617816396", "47918743755306585630071247991389662160", "90320165058021931767383223621283132405", "25652301680987172828517213841730144170", "186167342490246128988331065328875165621", "145079804260352517559297267693476946183", "270958262497982618998214295548258911279", "222739456146484954029573998889475780352", "334951624658366945285492077903980358926", "37001477771028326292229767023349440890", "340193210849633232090684683998124351142", "80084644866510519480419027006621445508", "102459536319354513070929098183781529195", "289794736789759278524507271740860914604", "57237917623675569214869953447193572993", "221621757692718643360303840497824853455", "179527262868024871688976240454254376896"], "threshold":0.9}, "id":"ASB-A-461507723-7b487072", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/avb/+/d2f20a12eabce52ebef18ed02ca44c4ac97a6a4c", "target":{"file":"libavb/avb_rsa.c"}}, {"deprecated":false, "digest":{"function_hash":"99121567533606075055862966666024805091", "length":1360}, "id":"ASB-A-461507723-af506b73", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/avb/+/d2f20a12eabce52ebef18ed02ca44c4ac97a6a4c", "target":{"file":"libavb/avb_rsa.c", "function":"modpowF4"}}]}}, {"package":{"name":"platform/external/avb", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/avb/+/88d897a6a52b484d190bd6bb6b01d9d8678b3b11"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["295888276594966255304195588615565650312", "43919443325846488345856449299617816396", "47918743755306585630071247991389662160", "90320165058021931767383223621283132405", "25652301680987172828517213841730144170", "186167342490246128988331065328875165621", "145079804260352517559297267693476946183", "270958262497982618998214295548258911279", "222739456146484954029573998889475780352", "334951624658366945285492077903980358926", "37001477771028326292229767023349440890", "340193210849633232090684683998124351142", "80084644866510519480419027006621445508", "102459536319354513070929098183781529195", "289794736789759278524507271740860914604", "57237917623675569214869953447193572993", "221621757692718643360303840497824853455", "179527262868024871688976240454254376896"], "threshold":0.9}, "id":"ASB-A-461507723-1e309872", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/avb/+/88d897a6a52b484d190bd6bb6b01d9d8678b3b11", "target":{"file":"libavb/avb_rsa.c"}}, {"deprecated":false, "digest":{"function_hash":"99121567533606075055862966666024805091", "length":1360}, "id":"ASB-A-461507723-b5b03191", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/avb/+/88d897a6a52b484d190bd6bb6b01d9d8678b3b11", "target":{"file":"libavb/avb_rsa.c", "function":"modpowF4"}}, {"deprecated":false, "digest":{"function_hash":"69548868784106392191353185226868731472", "length":1531}, "id":"ASB-A-461507723-c85f16a6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/avb/+/88d897a6a52b484d190bd6bb6b01d9d8678b3b11", "target":{"file":"libavb/avb_rsa.c", "function":"avb_rsa_verify"}}]}}, {"package":{"name":"platform/external/avb", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/avb/+/e8819556a9d3da7cb46005e9bbed970da4777455"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["295888276594966255304195588615565650312", "43919443325846488345856449299617816396", "47918743755306585630071247991389662160", "90320165058021931767383223621283132405", "25652301680987172828517213841730144170", "186167342490246128988331065328875165621", "145079804260352517559297267693476946183", "270958262497982618998214295548258911279", "222739456146484954029573998889475780352", "334951624658366945285492077903980358926", "37001477771028326292229767023349440890", "340193210849633232090684683998124351142", "237040744458659864527797877325660687507", "253166598775633115102591107008784942957", "289794736789759278524507271740860914604", "57237917623675569214869953447193572993", "221621757692718643360303840497824853455", "179527262868024871688976240454254376896"], "threshold":0.9}, "id":"ASB-A-461507723-38159e5a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/avb/+/e8819556a9d3da7cb46005e9bbed970da4777455", "target":{"file":"libavb/avb_rsa.c"}}, {"deprecated":false, "digest":{"function_hash":"59930707550007530595320650224867079192", "length":1197}, "id":"ASB-A-461507723-8e70628d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/avb/+/e8819556a9d3da7cb46005e9bbed970da4777455", "target":{"file":"libavb/avb_rsa.c", "function":"avb_rsa_verify"}}, {"deprecated":false, "digest":{"function_hash":"99121567533606075055862966666024805091", "length":1360}, "id":"ASB-A-461507723-f47218d7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/avb/+/e8819556a9d3da7cb46005e9bbed970da4777455", "target":{"file":"libavb/avb_rsa.c", "function":"modpowF4"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}