PT-2021-22685 · Google · Android Kernel

Published 2021-12-15 · Updated 2023-08-08 · CVE-2021-39640

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Android kernel

Description: The issue is related to a possible out of bounds write in the dwc3 gadget ep0 queue function of ep0.c due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not required for exploitation.

Recommendations: For Android kernel, consider applying a patch that properly implements locking mechanisms in the dwc3 gadget ep0 queue function to prevent out of bounds writes. As a temporary workaround, restrict access to sensitive areas of the kernel to minimize the risk of exploitation.

Fix

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

CVE-2021-39640

Affected Products

Android Kernel

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2021-39640 · Security Note
• https://source.android.com/security/bulletin/pixel/2021-12-01 · Vendor Advisory