{"id":"ASB-A-150226608","details":"In getLayerDebugInfo of SurfaceFlinger.cpp, there is a possible code execution due to a double free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-150226608","CVE-2020-0392"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2020-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2020-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/native/+/927b3b120839954a575b4e8c498b1b4d4d375afa"}],"affected":[{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9:0"},{"fixed":"9:2020-09-01"}]}],"versions":["9"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"services/surfaceflinger/SurfaceFlinger.h"},"deprecated":false,"digest":{"line_hashes":["279892208236253564008877748364442316453","212684056485600267638472651103858896529","251887410353660652079092738441179855112","322845906811849055248103031727735753750"],"threshold":0.9},"id":"ASB-A-150226608-05d16021","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/927b3b120839954a575b4e8c498b1b4d4d375afa"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/927b3b120839954a575b4e8c498b1b4d4d375afa","target":{"file":"libs/gui/ISurfaceComposer.cpp"},"deprecated":false,"digest":{"line_hashes":["223697908175301589635617829670166033825","103276583437563678454131510975309837669","190879393243834201331530337743556412059","4965345062133724478128712781051707213"],"threshold":0.9},"id":"ASB-A-150226608-077e3ad6","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/frameworks/native/+/927b3b120839954a575b4e8c498b1b4d4d375afa","target":{"file":"libs/gui/tests/Surface_test.cpp"},"deprecated":false,"digest":{"line_hashes":["278033471089196988739353975783395754424","76750493340843466445310418806504079228","96020788444478474301477768415534849114","16635247494696910248192472705054870586"],"threshold":0.9},"id":"ASB-A-150226608-3d29422d","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/927b3b120839954a575b4e8c498b1b4d4d375afa","target":{"file":"services/surfaceflinger/Layer.cpp"},"deprecated":false,"digest":{"line_hashes":["253013780927489254078431926363478233060","82998567570220766550797209981119914037","53866981525007040530969185145135367031","38629208550646971905814806094640344934"],"threshold":0.9},"id":"ASB-A-150226608-49ecd94b"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/927b3b120839954a575b4e8c498b1b4d4d375afa","target":{"file":"services/surfaceflinger/SurfaceFlinger.cpp"},"deprecated":false,"digest":{"line_hashes":["328444169892577800952769584335059202070","17780198377971919271829219589130742036","66681311962608104674274676257953871082","90660744020570539897597161225884379257","78510987932124128710458000306692172868","163180945899777767723129520919999956929","65410003161576778333030173614928359133","43885405959532513787725276534642191506","198368395584681117820390964865820924141","336459725639104140610566519283613431226","9186346653109451217684927591360330599","339916386276484476972215502416395060909","171657867540652853954989416980086770133","147364075805799238607239751437818631659","29094161073673199829934722024541142869","293108412750060418577208602340033442749","201333226247228512517691475016438013646","290763619202781511485156169261299622046"],"threshold":0.9},"id":"ASB-A-150226608-6d1ec002"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/927b3b120839954a575b4e8c498b1b4d4d375afa","target":{"file":"libs/gui/include/gui/ISurfaceComposer.h"},"deprecated":false,"digest":{"line_hashes":["16887627837282564350380534996385721230","278400392248205245869060571650135117049","28023980458228271308818976418887737798","21021764418948415105208395769017456056"],"threshold":0.9},"id":"ASB-A-150226608-bdf068f8","signature_type":"Line"},{"target":{"function":"Layer::getLayerDebugInfo","file":"services/surfaceflinger/Layer.cpp"},"deprecated":false,"digest":{"function_hash":"173584616515376182884654838254735231892","length":1735},"id":"ASB-A-150226608-fb6458b9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/927b3b120839954a575b4e8c498b1b4d4d375afa"}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/927b3b120839954a575b4e8c498b1b4d4d375afa"],"severity":"High","spl":"2020-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-150226608.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2020-09-01"}]}],"versions":["10"],"ecosystem_specific":{"severity":"High","spl":"2020-09-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/surfaceflinger/Layer.cpp"},"deprecated":false,"digest":{"line_hashes":["253013780927489254078431926363478233060","82998567570220766550797209981119914037","53866981525007040530969185145135367031","38629208550646971905814806094640344934"],"threshold":0.9},"id":"ASB-A-150226608-263b453e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/927b3b120839954a575b4e8c498b1b4d4d375afa"},{"deprecated":false,"digest":{"line_hashes":["279892208236253564008877748364442316453","212684056485600267638472651103858896529","251887410353660652079092738441179855112","322845906811849055248103031727735753750"],"threshold":0.9},"id":"ASB-A-150226608-4e8e6e67","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/927b3b120839954a575b4e8c498b1b4d4d375afa","target":{"file":"services/surfaceflinger/SurfaceFlinger.h"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/927b3b120839954a575b4e8c498b1b4d4d375afa","target":{"file":"services/surfaceflinger/SurfaceFlinger.cpp"},"deprecated":false,"digest":{"line_hashes":["328444169892577800952769584335059202070","17780198377971919271829219589130742036","66681311962608104674274676257953871082","90660744020570539897597161225884379257","78510987932124128710458000306692172868","163180945899777767723129520919999956929","65410003161576778333030173614928359133","43885405959532513787725276534642191506","198368395584681117820390964865820924141","336459725639104140610566519283613431226","9186346653109451217684927591360330599","339916386276484476972215502416395060909","171657867540652853954989416980086770133","147364075805799238607239751437818631659","29094161073673199829934722024541142869","293108412750060418577208602340033442749","201333226247228512517691475016438013646","290763619202781511485156169261299622046"],"threshold":0.9},"id":"ASB-A-150226608-90888a45","signature_type":"Line"},{"target":{"file":"services/surfaceflinger/Layer.cpp","function":"Layer::getLayerDebugInfo"},"deprecated":false,"digest":{"function_hash":"173584616515376182884654838254735231892","length":1735},"id":"ASB-A-150226608-970b11d3","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/927b3b120839954a575b4e8c498b1b4d4d375afa"},{"target":{"file":"libs/gui/include/gui/ISurfaceComposer.h"},"deprecated":false,"digest":{"line_hashes":["16887627837282564350380534996385721230","278400392248205245869060571650135117049","28023980458228271308818976418887737798","21021764418948415105208395769017456056"],"threshold":0.9},"id":"ASB-A-150226608-c6f28f91","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/927b3b120839954a575b4e8c498b1b4d4d375afa"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/927b3b120839954a575b4e8c498b1b4d4d375afa","target":{"file":"libs/gui/ISurfaceComposer.cpp"},"deprecated":false,"digest":{"line_hashes":["223697908175301589635617829670166033825","103276583437563678454131510975309837669","190879393243834201331530337743556412059","4965345062133724478128712781051707213"],"threshold":0.9},"id":"ASB-A-150226608-d1d44d6c"},{"id":"ASB-A-150226608-d2cfc9de","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/927b3b120839954a575b4e8c498b1b4d4d375afa","target":{"file":"libs/gui/tests/Surface_test.cpp"},"deprecated":false,"digest":{"line_hashes":["278033471089196988739353975783395754424","76750493340843466445310418806504079228","96020788444478474301477768415534849114","16635247494696910248192472705054870586"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/927b3b120839954a575b4e8c498b1b4d4d375afa"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-150226608.json"}}],"schema_version":"1.9.0"}