ASB-A-156071259

See a problem?
Import Source
https://storage.googleapis.com/android-osv-test/ASB-A-156071259.json
JSON Data
https://api.test.osv.dev/v1/vulns/ASB-A-156071259
Aliases
Published
2020-08-01T00:00:00Z
Modified
2025-08-06T16:29:06.385449Z
Summary
[none]
Details

In usbsgcancel of message.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / :linux_kernel:

Package

Name
:linux_kernel:

Affected ranges

Type
ECOSYSTEM
Events
Introduced
:0
Fixed
:2020-08-05

Affected versions

Other

Kernel

Ecosystem specific 

{
    "types": [
        "EoP"
    ],
    "severity": "High",
    "vanir_signatures": [
        {
            "source": "https://android.googlesource.com/kernel/common/+/056ad39ee925",
            "deprecated": false,
            "target": {
                "truncated_path_level": 1.0,
                "file": "drivers/usb/core/message.c"
            },
            "signature_version": "v1",
            "signature_type": "Line",
            "id": "ASB-A-156071259-7e12f48b",
            "digest": {
                "line_hashes": [
                    "255943705818962813189976031016472597529",
                    "26033224937548943097948035650581242614",
                    "526934606920560820297120827636957638",
                    "31740174451050260298108892113833111941",
                    "88334139816857127022371209949018334689",
                    "83400255864374188643152245675839267384",
                    "18976699313310297325405290768711954450",
                    "295323004618949905759279342173215295091",
                    "87686149460333506480774470036864217880",
                    "243721719629647059646551031181529773032",
                    "148076998368388731406663931420594976352",
                    "152475867996944593949176481686230090508"
                ],
                "threshold": 0.9
            }
        },
        {
            "source": "https://android.googlesource.com/kernel/common/+/056ad39ee925",
            "deprecated": false,
            "target": {
                "truncated_path_level": 1.0,
                "file": "drivers/usb/core/message.c",
                "function": "usb_sg_cancel"
            },
            "signature_version": "v1",
            "signature_type": "Function",
            "id": "ASB-A-156071259-e647a430",
            "digest": {
                "function_hash": "3645988281826647388253086379590913140",
                "length": 555.0
            }
        }
    ],
    "spl": "2020-08-05",
    "fixes": [
        "https://android.googlesource.com/kernel/common/+/056ad39ee925"
    ]
}