{"schema_version":"1.9.0","id":"PUB-A-189614572","published":"2022-06-01T00:00:00Z","modified":"2026-09-08T15:39:03.104189951Z","aliases":["A-189614572","CVE-2021-31440"],"details":"In __reg_combine_64_into_32 of verifier.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.","affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2022-06-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/10bf4e83167cc68595b85fd73bb91e8f2c086e36"],"severity":"Moderate","spl":"2022-06-05","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["212800518964856369389521039055908099567","82273670456639605227239471073467140106","50008848994886776224202410070084048693","48815854679998796205627619671552671693","56117137677885794378404042146766944008","7714330957514461825118800607800836312","194023082526570537671120246501057808347","98686218519325842007826455435370768894","138936556559382611282609909065800626524","43062552875737140688457285069473463391","336457266308252773091089041388094062563","130621889521883767811136362258739594220","338345996073162864158169348820637845904"],"threshold":0.9},"id":"PUB-A-189614572-687c26a4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/10bf4e83167cc68595b85fd73bb91e8f2c086e36","target":{"file":"kernel/bpf/verifier.c"}},{"deprecated":false,"digest":{"function_hash":"338367937152586792507715085095752982057","length":515},"id":"PUB-A-189614572-6967b176","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/10bf4e83167cc68595b85fd73bb91e8f2c086e36","target":{"file":"kernel/bpf/verifier.c","function":"__reg_combine_64_into_32"}},{"deprecated":true,"digest":{"line_hashes":["111124125518037698107137039674281182555","160228749372670470806794121772081665154","240077756689326179944605277824869898578","293048743713854453730306841156756314741"],"threshold":0.9},"id":"PUB-A-189614572-a2b0ebc8","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/10bf4e83167cc68595b85fd73bb91e8f2c086e36","target":{"file":"tools/testing/selftests/bpf/verifier/array_access.c"}},{"deprecated":false,"digest":{"function_hash":"249470159820716899772598315201185433996","length":112},"id":"PUB-A-189614572-ba532bbf","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/10bf4e83167cc68595b85fd73bb91e8f2c086e36","target":{"file":"kernel/bpf/verifier.c","function":"__reg64_bound_u32"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-189614572.json"}}],"references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-06-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/10bf4e83167cc68595b85fd73bb91e8f2c086e36"}]}