PT-2020-1268 · Google · Android Kernel

Published 2020-09-02 · Updated 2025-12-08 · CVE-2021-1048

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android kernel versions (affected versions not specified)

Description The issue is related to a use-after-free vulnerability in the ep loop check proc function of eventpoll.c. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. The vulnerability is an object state confusion with use-after-free that was patched in the upstream Linux kernel but forgotten by some Android vendors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ASB-A-204573007

BDU:2021-05539

CVE-2021-1048

Affected Products

Android Kernel

References · 42

• https://cve.org/CVERecord?id=CVE-2021-1048 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-1048 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-1048 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1048 · Vendor Advisory
• https://source.android.com/security/bulletin/2021-11-01 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-9088.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-1048 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05539 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/674365 · Security Note
• https://linux.oracle.com/errata/ELSA-2022-9014.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1048 · Security Note
• https://ubuntu.com/security/CVE-2021-1048 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-204573007 · Vendor Advisory
• https://t.me/linkersec/137 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021110302 · Note