In multiple functions of quirks.c, there is a possible way to free arbitrary memory due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"vanir_signatures": [
{
"id": "ASB-A-382243530-1316d80e",
"signature_type": "Function",
"digest": {
"length": 901.0,
"function_hash": "149865222751904324294654490599554875005"
},
"source": "https://partner-android.googlesource.com/kernel/common/+/a84242054bec905a3c63d5701256a6f4af6bce81",
"target": {
"function": "snd_usb_mbox3_boot_quirk",
"file": "sound/usb/quirks.c"
},
"signature_version": "v1",
"deprecated": false
},
{
"id": "ASB-A-382243530-3495d05f",
"signature_type": "Function",
"digest": {
"length": 1536.0,
"function_hash": "114082801913863411111916967027200975283"
},
"source": "https://partner-android.googlesource.com/kernel/common/+/a84242054bec905a3c63d5701256a6f4af6bce81",
"target": {
"function": "snd_usb_mbox2_boot_quirk",
"file": "sound/usb/quirks.c"
},
"signature_version": "v1",
"deprecated": false
},
{
"id": "ASB-A-382243530-44278c79",
"signature_type": "Function",
"digest": {
"length": 1536.0,
"function_hash": "114082801913863411111916967027200975283"
},
"source": "https://partner-android.googlesource.com/kernel/common/+/5486704a6a0c592692efe67461dfa8db51fdc684",
"target": {
"function": "snd_usb_mbox2_boot_quirk",
"file": "sound/usb/quirks.c"
},
"signature_version": "v1",
"deprecated": false
},
{
"id": "ASB-A-382243530-63628064",
"signature_type": "Line",
"digest": {
"line_hashes": [
"4596325388915008981299882468003979678",
"117538277251158576169632553323025276867",
"128720640318649124984724844766591494427",
"248388793769995810708961935945717898508",
"18583310606235471713331773034534499253",
"38442455409447277707644901197745318391",
"13899572167681943313544065699117070482",
"147545270504045940631543831775116095149",
"165726875418486070304294400466485754803",
"204804844893188247352894776146587916295",
"293241501077110442061361593328233040718",
"229479838302465359324651441298612498710",
"326243252985604367500262435109357834875",
"68647310966918190091767486171462814763",
"22336160152296457165851039365302580492",
"250352466211041736840666677877697125206",
"277448354138740027466293073524968999005",
"13899572167681943313544065699117070482",
"147545270504045940631543831775116095149",
"165726875418486070304294400466485754803",
"204804844893188247352894776146587916295",
"293241501077110442061361593328233040718",
"302580069370621221734915655222288481720",
"228123083587912899020469896689621053267",
"845121499220581854700123676984591825",
"148906423356710753373076640961531287768",
"250352466211041736840666677877697125206",
"277448354138740027466293073524968999005",
"13899572167681943313544065699117070482",
"147545270504045940631543831775116095149",
"165726875418486070304294400466485754803",
"204804844893188247352894776146587916295",
"293241501077110442061361593328233040718"
],
"threshold": 0.9
},
"source": "https://partner-android.googlesource.com/kernel/common/+/a84242054bec905a3c63d5701256a6f4af6bce81",
"target": {
"file": "sound/usb/quirks.c"
},
"signature_version": "v1",
"deprecated": false
},
{
"id": "ASB-A-382243530-a0a8b158",
"signature_type": "Line",
"digest": {
"line_hashes": [
"4596325388915008981299882468003979678",
"117538277251158576169632553323025276867",
"128720640318649124984724844766591494427",
"248388793769995810708961935945717898508",
"18583310606235471713331773034534499253",
"38442455409447277707644901197745318391",
"13899572167681943313544065699117070482",
"147545270504045940631543831775116095149",
"165726875418486070304294400466485754803",
"204804844893188247352894776146587916295",
"293241501077110442061361593328233040718",
"229479838302465359324651441298612498710",
"326243252985604367500262435109357834875",
"68647310966918190091767486171462814763",
"22336160152296457165851039365302580492",
"250352466211041736840666677877697125206",
"277448354138740027466293073524968999005",
"13899572167681943313544065699117070482",
"147545270504045940631543831775116095149",
"165726875418486070304294400466485754803",
"204804844893188247352894776146587916295",
"293241501077110442061361593328233040718",
"114703726274791127071022913378976971627",
"205525993595208785241876160429196459346",
"51455053824969455025319149621323926812"
],
"threshold": 0.9
},
"source": "https://partner-android.googlesource.com/kernel/common/+/5486704a6a0c592692efe67461dfa8db51fdc684",
"target": {
"file": "sound/usb/quirks.c"
},
"signature_version": "v1",
"deprecated": false
},
{
"id": "ASB-A-382243530-c7eaa5ad",
"signature_type": "Function",
"digest": {
"length": 1011.0,
"function_hash": "19012591602693493290712050937359852809"
},
"source": "https://partner-android.googlesource.com/kernel/common/+/5486704a6a0c592692efe67461dfa8db51fdc684",
"target": {
"function": "snd_usb_extigy_boot_quirk",
"file": "sound/usb/quirks.c"
},
"signature_version": "v1",
"deprecated": false
},
{
"id": "ASB-A-382243530-ca18dffe",
"signature_type": "Function",
"digest": {
"length": 1011.0,
"function_hash": "19012591602693493290712050937359852809"
},
"source": "https://partner-android.googlesource.com/kernel/common/+/a84242054bec905a3c63d5701256a6f4af6bce81",
"target": {
"function": "snd_usb_extigy_boot_quirk",
"file": "sound/usb/quirks.c"
},
"signature_version": "v1",
"deprecated": false
}
],
"severity": "High",
"types": [
"EoP"
],
"spl": "2025-04-05",
"fixes": [
"https://android.googlesource.com/kernel/common/+/5486704a6a0c592692efe67461dfa8db51fdc684",
"https://android.googlesource.com/kernel/common/+/a84242054bec905a3c63d5701256a6f4af6bce81"
]
}