PUB-A-168607263

See a problem?
Import Source
https://storage.googleapis.com/android-osv-test/PUB-A-168607263.json
JSON Data
https://api.osv.dev/v1/vulns/PUB-A-168607263
Aliases
Published
2021-10-01T00:00:00Z
Modified
2024-09-19T16:27:42.358112Z
Summary
[A slab-out-of-bounds problem in ip6_xmit() in net/ipv6 subsystem]
Details

In ip6xmit of ip6output.c, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / :linux_kernel:

Package

Name
:linux_kernel:

Affected ranges

Type
ECOSYSTEM
Events
Introduced
:0
Fixed
:2021-10-05

Affected versions

Other

Kernel

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "25334347920569522898254242025624038336",
                    "234163967402709932542124777912514585765",
                    "287887375150421422070902850653839315346",
                    "307438346234822931023662687975222642135",
                    "42229323460979589077548826378825127077",
                    "220203633376058270147357934668866355459"
                ]
            },
            "id": "PUB-A-168607263-32496ed4",
            "source": "https://android.googlesource.com/kernel/common/+/b954f94023dcc61388c8384f0f14eb8e42c863c5",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "net/l2tp/l2tp_core.h"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "length": 1222.0,
                "function_hash": "277558364663445662139063537660023885451"
            },
            "id": "PUB-A-168607263-4d4ba5f3",
            "source": "https://android.googlesource.com/kernel/common/+/b954f94023dcc61388c8384f0f14eb8e42c863c5",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "net/l2tp/l2tp_core.c",
                "function": "l2tp_xmit_core"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "30629078674881629507075756819812156032",
                    "290645555834032544297216613742360696443",
                    "332525058662962417552872165360775992143",
                    "130005574254180922053579103016478734896",
                    "298956824246871880746286545511068294466",
                    "134737045916994505465141234724924214030",
                    "109237579484837761712802639441019018252",
                    "199140676095963936663639144872808313891",
                    "113968269329523453572336784754258693694",
                    "195937048687659792578478194690921366441",
                    "264955549298918178805362998687553504720",
                    "203710946741074400395065047677231819394",
                    "246363828384079040570870416630862052497",
                    "211292513538822540770227675455853336668",
                    "220775383026815692482485608771079691346",
                    "211118441377423645131046640603276180323",
                    "10238047762864665048088382665974168808"
                ]
            },
            "id": "PUB-A-168607263-96b0a4eb",
            "source": "https://android.googlesource.com/kernel/common/+/2f987a76a97773beafbc615b9c4d8fe79129a7f4",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "net/ipv6/datagram.c"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "199805753334809386284240512017764486292",
                    "323297787826819263595689686456346211692",
                    "292624445830910953521017318505564285805",
                    "87816736335125847665056783845001028952",
                    "137556485212565658218546780433540473572",
                    "271616414432750161014771795714854805253",
                    "211990197813252145987022873279620318545",
                    "71831598799121006441233787108676186513",
                    "8176067402559171210308349273152146965",
                    "161883870379513453416109884586725860113",
                    "214451366990645929052225211280220976135",
                    "192914710129082849274294858012166361981",
                    "10087131679957325745346652867292524160",
                    "98477657405847844323148939807707345225",
                    "223944148276776784586217380532339177134",
                    "74172547960012552282123975037141029344",
                    "20518833492046021708765252229217275173",
                    "51421111569908637352408420806193255624",
                    "50213681984823527403630023363886087999",
                    "80913677579399052783671807507998446715",
                    "287373640473665033622544459376464751562",
                    "198781904341809177664854925488896028647",
                    "272025263074667212532466535156235330523",
                    "4251406668809995148891833693721132452",
                    "257854619223803227125315430149388733747",
                    "205819134824305476287386405979756165174",
                    "199203250900819989315682867461251079292",
                    "97743353004573830358496417400109528479",
                    "109780402459101146203937352085247859902",
                    "237407310431148557666477520853072572474",
                    "156872910084313152968311290634198524461",
                    "166791386586957100649197820374998959942"
                ]
            },
            "id": "PUB-A-168607263-d478fe55",
            "source": "https://android.googlesource.com/kernel/common/+/b954f94023dcc61388c8384f0f14eb8e42c863c5",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "net/l2tp/l2tp_core.c"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "length": 2310.0,
                "function_hash": "326151537545061741695079361850998252937"
            },
            "id": "PUB-A-168607263-d6255408",
            "source": "https://android.googlesource.com/kernel/common/+/2f987a76a97773beafbc615b9c4d8fe79129a7f4",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "net/ipv6/datagram.c",
                "function": "__ip6_datagram_connect"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "length": 3305.0,
                "function_hash": "283375205806437250461796966017913460870"
            },
            "id": "PUB-A-168607263-daca99b9",
            "source": "https://android.googlesource.com/kernel/common/+/b954f94023dcc61388c8384f0f14eb8e42c863c5",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "net/l2tp/l2tp_core.c",
                "function": "l2tp_tunnel_create"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "length": 1659.0,
                "function_hash": "314349946728839780801224023225017247234"
            },
            "id": "PUB-A-168607263-dd6e6da2",
            "source": "https://android.googlesource.com/kernel/common/+/b954f94023dcc61388c8384f0f14eb8e42c863c5",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "net/l2tp/l2tp_core.c",
                "function": "l2tp_xmit_skb"
            },
            "signature_type": "Function"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/kernel/common/+/2f987a76a97773beafbc615b9c4d8fe79129a7f4",
        "https://android.googlesource.com/kernel/common/+/b954f94023dcc61388c8384f0f14eb8e42c863c5"
    ],
    "spl": "2021-10-05",
    "severity": "Moderate",
    "types": [
        "EoP"
    ]
}