ASB-A-220741611

See a problem?
Import Source
https://storage.googleapis.com/android-osv-test/ASB-A-220741611.json
JSON Data
https://api.test.osv.dev/v1/vulns/ASB-A-220741611
Aliases
Published
2022-05-01T00:00:00Z
Modified
2025-08-06T16:29:06.385449Z
Summary
[none]
Details

In multiple functions of iov_iter.c, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privilege in system libraries with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / :linux_kernel:

Package

Name
:linux_kernel:

Affected ranges

Type
ECOSYSTEM
Events
Introduced
:0
Fixed
:2022-05-05

Affected versions

Other

Kernel

Ecosystem specific 

{
    "spl": "2022-05-05",
    "severity": "High",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "id": "ASB-A-220741611-0d0bc08c",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Function",
            "digest": {
                "function_hash": "339689791828797232024530409227774779441",
                "length": 996.0
            },
            "target": {
                "file": "lib/iov_iter.c",
                "function": "push_pipe"
            },
            "source": "https://android.googlesource.com/kernel/common/+/b9b8fd203dba3"
        },
        {
            "id": "ASB-A-220741611-1195352e",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Line",
            "digest": {
                "line_hashes": [
                    "134436877735195479399431085792838987467",
                    "232980826822544885754214897579198116529",
                    "217024493674096007528144937323210585157",
                    "144648163504042365693439419794279883660",
                    "74186965640530955316531541713336962193",
                    "266087078819064697008367606713792713038",
                    "212389789156659759290233420496431435880",
                    "332634056076018835733964202215024247512"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "lib/iov_iter.c"
            },
            "source": "https://android.googlesource.com/kernel/common/+/aa3e9c7480830f38390a61501386be4a03efb88d"
        },
        {
            "id": "ASB-A-220741611-1bb580e1",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Function",
            "digest": {
                "function_hash": "190579346138162308382343159614563282947",
                "length": 961.0
            },
            "target": {
                "file": "lib/iov_iter.c",
                "function": "copy_page_to_iter_pipe"
            },
            "source": "https://android.googlesource.com/kernel/common/+/b19ec7afa9297"
        },
        {
            "id": "ASB-A-220741611-2ba35c95",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Function",
            "digest": {
                "function_hash": "190579346138162308382343159614563282947",
                "length": 961.0
            },
            "target": {
                "file": "lib/iov_iter.c",
                "function": "copy_page_to_iter_pipe"
            },
            "source": "https://android.googlesource.com/kernel/common/+/b9b8fd203dba3"
        },
        {
            "id": "ASB-A-220741611-424ccc2d",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Line",
            "digest": {
                "line_hashes": [
                    "134436877735195479399431085792838987467",
                    "232980826822544885754214897579198116529",
                    "217024493674096007528144937323210585157",
                    "144648163504042365693439419794279883660",
                    "74186965640530955316531541713336962193",
                    "266087078819064697008367606713792713038",
                    "212389789156659759290233420496431435880",
                    "332634056076018835733964202215024247512"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "lib/iov_iter.c"
            },
            "source": "https://android.googlesource.com/kernel/common/+/b19ec7afa9297"
        },
        {
            "id": "ASB-A-220741611-4e980db0",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Line",
            "digest": {
                "line_hashes": [
                    "134436877735195479399431085792838987467",
                    "232980826822544885754214897579198116529",
                    "217024493674096007528144937323210585157",
                    "144648163504042365693439419794279883660",
                    "74186965640530955316531541713336962193",
                    "266087078819064697008367606713792713038",
                    "212389789156659759290233420496431435880",
                    "332634056076018835733964202215024247512"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "lib/iov_iter.c"
            },
            "source": "https://android.googlesource.com/kernel/common/+/b9b8fd203dba3"
        },
        {
            "id": "ASB-A-220741611-7378aae4",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Function",
            "digest": {
                "function_hash": "339689791828797232024530409227774779441",
                "length": 996.0
            },
            "target": {
                "file": "lib/iov_iter.c",
                "function": "push_pipe"
            },
            "source": "https://android.googlesource.com/kernel/common/+/aa3e9c7480830f38390a61501386be4a03efb88d"
        },
        {
            "id": "ASB-A-220741611-75618f6f",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Function",
            "digest": {
                "function_hash": "339689791828797232024530409227774779441",
                "length": 996.0
            },
            "target": {
                "file": "lib/iov_iter.c",
                "function": "push_pipe"
            },
            "source": "https://android.googlesource.com/kernel/common/+/b19ec7afa9297"
        },
        {
            "id": "ASB-A-220741611-d191cbac",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Function",
            "digest": {
                "function_hash": "190579346138162308382343159614563282947",
                "length": 961.0
            },
            "target": {
                "file": "lib/iov_iter.c",
                "function": "copy_page_to_iter_pipe"
            },
            "source": "https://android.googlesource.com/kernel/common/+/aa3e9c7480830f38390a61501386be4a03efb88d"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/kernel/common/+/b9b8fd203dba3",
        "https://android.googlesource.com/kernel/common/+/b19ec7afa9297",
        "https://android.googlesource.com/kernel/common/+/aa3e9c7480830f38390a61501386be4a03efb88d"
    ]
}