In cgroup1parseparam of cgroup-v1.c, there is a possible container breakout due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"types": [
"EoP"
],
"severity": "High",
"vanir_signatures": [
{
"source": "https://android.googlesource.com/kernel/common/+/811763e3beb6c",
"deprecated": false,
"digest": {
"line_hashes": [
"191251821101608297518000102230053641",
"161478230760747823243509515755670125340",
"53748005745504328288671075488780645792",
"268088281257053229139836659380680159012"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "ASB-A-218836280-0a0279e2",
"signature_type": "Line",
"target": {
"file": "kernel/cgroup/cgroup-v1.c"
}
},
{
"source": "https://android.googlesource.com/kernel/common/+/811763e3beb6c",
"deprecated": false,
"digest": {
"function_hash": "43562121027514138802384445818688810638",
"length": 1976.0
},
"signature_version": "v1",
"id": "ASB-A-218836280-f8ce5168",
"signature_type": "Function",
"target": {
"file": "kernel/cgroup/cgroup-v1.c",
"function": "cgroup1_parse_param"
}
}
],
"spl": "2022-06-05",
"fixes": [
"https://android.googlesource.com/kernel/common/+/811763e3beb6c"
]
}