Lucene search

[email protected]CVE-2021-0920

HistoryDec 15, 2021 - 7:15 p.m.

CVE-2021-0920

2021-12-1519:15:11

CWE-416

CWE-362

[email protected]

web.nvd.nist.gov

1150

In Wild

cve-2021-0920

af_unix.c

race condition

local escalation

privilege escalation

android

kernel

nvd

6.4 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

7.1 High

AI Score

Confidence

High

6.9 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

28.0%

JSON

In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel

Affected configurations

NVD

Node

googleandroid

Node

debiandebian_linuxMatch9.0

CPENameOperatorVersion
google:androidgoogle androideq*

CPE	Name	Operator	Version
google:android	google android	eq	*

CNA Affected

[
  {
    "product": "Android",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Android kernel"
      }
    ]
  }
]