PT-2019-1114 · Google+1 · Android Kernel+1

Published 2019-11-25 · Updated 2021-12-17 · CVE-2021-0929

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Android kernel (affected versions not specified)

Description: The issue is related to the use of previously freed memory in the ion dma buf end cpu access() function of the ion.c module. This could lead to memory corruption and potentially allow an attacker to cause a denial of service or escalate privileges locally without needing additional execution privileges. User interaction is not required for exploitation.

Recommendations: For Linux kernel: At the moment, there is no information about a newer version that contains a fix for this vulnerability. For Android kernel: Consider restricting access to the ion dma buf end cpu access() function as a temporary workaround until a patch is available.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ASB-A-187527909

BDU:2023-00701

CVE-2021-0929

OESA-2021-1429

Affected Products

Android Kernel

Linux Kernel

References · 24

• https://nvd.nist.gov/vuln/detail/CVE-2021-3896 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-43389 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-0929 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-0929 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-0929 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-0929 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-0929 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20320 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-3760 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-3702 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-16119 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-34981 · Security Note
• https://osv.dev/vulnerability/ASB-A-187527909 · Vendor Advisory
• https://source.android.com/security/bulletin/2021-11-01 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-0929 · Vendor Advisory