PUB-A-184847809

See a problem?
Import Source
https://storage.googleapis.com/android-osv-test/PUB-A-184847809.json
JSON Data
https://api.osv.dev/v1/vulns/PUB-A-184847809
Aliases
Published
2021-10-01T00:00:00Z
Modified
2024-09-19T16:26:54.523710Z
Summary
Heap out-of-bounds write (LPE) in xt_compat_target_from_user
Details

In xtcompattargetfromuser of x_tables.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / :linux_kernel:

Package

Name
:linux_kernel:

Affected ranges

Type
ECOSYSTEM
Events
Introduced
:0
Fixed
:2021-10-05

Affected versions

Other

Kernel

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "250593423097289763518840416180899252212",
                    "56390249934687615994851625980461256314",
                    "44907493427482642542144014318836975935"
                ]
            },
            "id": "PUB-A-184847809-877d7e4d",
            "source": "https://android.googlesource.com/kernel/common/+/b29c457a6511435960115c0f548c4360d5f4801d",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "net/ipv4/netfilter/arp_tables.c"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "250593423097289763518840416180899252212",
                    "119879805833018606111565140004790775799",
                    "286273123140828989782977022154800889535"
                ]
            },
            "id": "PUB-A-184847809-9d52b6eb",
            "source": "https://android.googlesource.com/kernel/common/+/b29c457a6511435960115c0f548c4360d5f4801d",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "net/ipv4/netfilter/ip_tables.c"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "length": 890.0,
                "function_hash": "112288550243795503554430237613510029675"
            },
            "id": "PUB-A-184847809-a9136302",
            "source": "https://android.googlesource.com/kernel/common/+/b29c457a6511435960115c0f548c4360d5f4801d",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "net/netfilter/x_tables.c",
                "function": "xt_compat_match_from_user"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "237625373789119390297176254960999706686",
                    "87577102913339808911945406432417054980",
                    "243149214489725621541896354095193215924",
                    "313533428094189779041700895437307180839",
                    "186947883349826844037560801970397235720",
                    "46953266724719743053130448565998017486",
                    "159182069764060489028296633136037278452",
                    "202674605857400815217350527310405552826",
                    "311565438486735987236693172628904305829",
                    "312786693420077244834599205298359989291",
                    "233758488829787199263408386307959095352",
                    "186349778077549529145395568979397022184",
                    "198239097157250657917742105892836947106",
                    "283350923594782428460620313757488673462",
                    "219860415905888908800391479734134435079",
                    "154263896549576825054297909621619357568",
                    "78777577887932545426992826309313531371",
                    "12210854144912036641856345140459556251",
                    "316008391328661218427615984556571210351",
                    "202721992762595883108358859022662568251"
                ]
            },
            "id": "PUB-A-184847809-aa97388e",
            "source": "https://android.googlesource.com/kernel/common/+/b29c457a6511435960115c0f548c4360d5f4801d",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "net/netfilter/x_tables.c"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "length": 895.0,
                "function_hash": "237265457552964565150363111904283971957"
            },
            "id": "PUB-A-184847809-c4d75a1a",
            "source": "https://android.googlesource.com/kernel/common/+/b29c457a6511435960115c0f548c4360d5f4801d",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "net/netfilter/x_tables.c",
                "function": "xt_compat_target_from_user"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "length": 1812.0,
                "function_hash": "197367519223820433962020977817939286027"
            },
            "id": "PUB-A-184847809-ceb06cdc",
            "source": "https://android.googlesource.com/kernel/common/+/b29c457a6511435960115c0f548c4360d5f4801d",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "net/ipv4/netfilter/arp_tables.c",
                "function": "translate_compat_table"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "250593423097289763518840416180899252212",
                    "119879805833018606111565140004790775799",
                    "286273123140828989782977022154800889535"
                ]
            },
            "id": "PUB-A-184847809-dda47bcd",
            "source": "https://android.googlesource.com/kernel/common/+/b29c457a6511435960115c0f548c4360d5f4801d",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "net/ipv6/netfilter/ip6_tables.c"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "length": 1790.0,
                "function_hash": "334980115648599037794136451126372025221"
            },
            "id": "PUB-A-184847809-e7f612d9",
            "source": "https://android.googlesource.com/kernel/common/+/b29c457a6511435960115c0f548c4360d5f4801d",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "net/ipv4/netfilter/ip_tables.c",
                "function": "translate_compat_table"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "length": 1796.0,
                "function_hash": "312055223986413050891550474343679527242"
            },
            "id": "PUB-A-184847809-f9d2d880",
            "source": "https://android.googlesource.com/kernel/common/+/b29c457a6511435960115c0f548c4360d5f4801d",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "net/ipv6/netfilter/ip6_tables.c",
                "function": "translate_compat_table"
            },
            "signature_type": "Function"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/kernel/common/+/b29c457a6511435960115c0f548c4360d5f4801d"
    ],
    "spl": "2021-10-05",
    "severity": "Moderate",
    "types": [
        "EoP"
    ]
}