{"id":"ASB-A-151644303","details":"In clearPropValue of MediaAnalyticsItem.cpp, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the media server with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-151644303","CVE-2020-0243"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2020-08-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2020-08-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/av/+/36a66d535b38245d386f2b5fd3ffbdcbbd0f3289"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52"}],"affected":[{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0:0"},{"fixed":"8.0:2020-08-01"}]}],"versions":["8.0"],"ecosystem_specific":{"severity":"High","spl":"2020-08-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"119514076358916030166398816307305096955","length":245},"id":"ASB-A-151644303-1a868f09","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"function":"NuPlayerDriver::~NuPlayerDriver","file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp"}},{"source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::updateMetrics"},"deprecated":false,"digest":{"function_hash":"19970835269334683979683547178283901791","length":2130},"id":"ASB-A-151644303-614cb9fb","signature_type":"Function","signature_version":"v1"},{"target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::logMetrics"},"deprecated":false,"digest":{"function_hash":"16733455476364751386489623831865073483","length":594},"id":"ASB-A-151644303-66081494","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52"},{"digest":{"function_hash":"229611388859470585784565905170352380863","length":181},"id":"ASB-A-151644303-92f3590f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"function":"NuPlayerDriver::setUID","file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.h"},"deprecated":false,"digest":{"line_hashes":["285693742590668977864572485398167092788","163354062488960643812532540975635500944","149807217642544446754387382624414796857","122005495037328633938150858824226178426"],"threshold":0.9},"id":"ASB-A-151644303-a6c8ee1f"},{"digest":{"function_hash":"338517978009753270771075971955006194024","length":1372},"id":"ASB-A-151644303-cd553dfd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::notifyListener_l"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["68762050946771697909153949919300292353","115136153507478749229531670102787782968","57975181769065734848698804904215535020","94985156930797785515687696151323669870","215130344324707041168855055689814716577","149444718171788907227940664294514945932","283109304772066993894798419244945953654","75540971250215794128160525218375513470","79184933469946688309994126175862956930","284370207654256253207498251055580374605","158764811638399078070390527706018330785","132960497475179756936280411028795213029","90231484915474161111665324090744072697","171434388312040294206175305564639900192","317051119088722702455309269789605940045","230375219837531452191070182776909129162","203429538992895337513326144881183564460","167553722907564739993014628430888159571","201734540577200677347955937809129639032","84837435922442434991123958438193803019","332329815085618130380038266150578484591","231641427403628256543074046836237567694","285632608063057880088894693718025176312","72957773220694104424787652424373743582","276658915807023810039989049567380792692","310914620801247333527217062202233634882","29596156925072181809153800740039148252","326618135817771068816859199940112541631","132373818188828183485415184249574358212","162270660663605029679584607000692223331","223880047302031816845651769514361294768","135582123997148526978912225769921059129","94682963605914528154339593602898404304","294781077198013897192040493756506891373","162107980502403396874032718139266553473","213717078337946846992035212692571629749","329290485897673505570119194292763190506","85005565345317875519306389160181804954","103008366326069690208917903507325086265","291842477210511642350752805904168934404","335509452559260605908244674348832981680","312074861960969291741538384139257579035","256383471407669284505191812758180168435","16851598889783919493885661792046389938"]},"id":"ASB-A-151644303-d43e41cd","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp"}},{"id":"ASB-A-151644303-e2b472e6","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::getParameter"},"deprecated":false,"digest":{"function_hash":"284467511168557220306610799003606564379","length":257}}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/36a66d535b38245d386f2b5fd3ffbdcbbd0f3289","https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-151644303.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1:0"},{"fixed":"8.1:2020-08-01"}]}],"versions":["8.1"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"function_hash":"119514076358916030166398816307305096955","length":245},"id":"ASB-A-151644303-07b59800","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::~NuPlayerDriver"},"deprecated":false},{"id":"ASB-A-151644303-41b89128","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"function":"NuPlayerDriver::logMetrics","file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp"},"deprecated":false,"digest":{"length":594,"function_hash":"16733455476364751386489623831865073483"}},{"source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.h"},"deprecated":false,"digest":{"line_hashes":["285693742590668977864572485398167092788","163354062488960643812532540975635500944","149807217642544446754387382624414796857","122005495037328633938150858824226178426"],"threshold":0.9},"id":"ASB-A-151644303-5527fbcc","signature_type":"Line","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::notifyListener_l"},"deprecated":false,"digest":{"function_hash":"338517978009753270771075971955006194024","length":1372},"id":"ASB-A-151644303-8ddba030","signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"function":"NuPlayerDriver::setUID","file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp"},"deprecated":false,"digest":{"function_hash":"229611388859470585784565905170352380863","length":181},"id":"ASB-A-151644303-9e77a067","signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["68762050946771697909153949919300292353","115136153507478749229531670102787782968","57975181769065734848698804904215535020","94985156930797785515687696151323669870","215130344324707041168855055689814716577","149444718171788907227940664294514945932","283109304772066993894798419244945953654","75540971250215794128160525218375513470","79184933469946688309994126175862956930","284370207654256253207498251055580374605","158764811638399078070390527706018330785","132960497475179756936280411028795213029","90231484915474161111665324090744072697","171434388312040294206175305564639900192","317051119088722702455309269789605940045","230375219837531452191070182776909129162","203429538992895337513326144881183564460","167553722907564739993014628430888159571","201734540577200677347955937809129639032","84837435922442434991123958438193803019","332329815085618130380038266150578484591","231641427403628256543074046836237567694","285632608063057880088894693718025176312","72957773220694104424787652424373743582","276658915807023810039989049567380792692","310914620801247333527217062202233634882","29596156925072181809153800740039148252","326618135817771068816859199940112541631","132373818188828183485415184249574358212","162270660663605029679584607000692223331","223880047302031816845651769514361294768","135582123997148526978912225769921059129","94682963605914528154339593602898404304","294781077198013897192040493756506891373","162107980502403396874032718139266553473","213717078337946846992035212692571629749","329290485897673505570119194292763190506","85005565345317875519306389160181804954","103008366326069690208917903507325086265","291842477210511642350752805904168934404","335509452559260605908244674348832981680","312074861960969291741538384139257579035","256383471407669284505191812758180168435","16851598889783919493885661792046389938"]},"id":"ASB-A-151644303-aa9ed9ba","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::getParameter"},"deprecated":false,"digest":{"length":257,"function_hash":"284467511168557220306610799003606564379"},"id":"ASB-A-151644303-b48a8970"},{"source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::updateMetrics"},"deprecated":false,"digest":{"function_hash":"19970835269334683979683547178283901791","length":2130},"id":"ASB-A-151644303-dd56f3fa","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/36a66d535b38245d386f2b5fd3ffbdcbbd0f3289","https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52"],"severity":"High","spl":"2020-08-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-151644303.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9:0"},{"fixed":"9:2020-08-01"}]}],"versions":["9"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"id":"ASB-A-151644303-2ba22008","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::~NuPlayerDriver"},"deprecated":false,"digest":{"function_hash":"119514076358916030166398816307305096955","length":245}},{"digest":{"function_hash":"16733455476364751386489623831865073483","length":594},"id":"ASB-A-151644303-4a87abec","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::logMetrics"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::setUID"},"deprecated":false,"digest":{"function_hash":"229611388859470585784565905170352380863","length":181},"id":"ASB-A-151644303-87f49ea6","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.h"},"deprecated":false,"digest":{"line_hashes":["285693742590668977864572485398167092788","163354062488960643812532540975635500944","149807217642544446754387382624414796857","122005495037328633938150858824226178426"],"threshold":0.9},"id":"ASB-A-151644303-a06deb34","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::notifyListener_l"},"deprecated":false,"digest":{"function_hash":"338517978009753270771075971955006194024","length":1372},"id":"ASB-A-151644303-bf097827"},{"id":"ASB-A-151644303-cd5dd994","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["68762050946771697909153949919300292353","115136153507478749229531670102787782968","57975181769065734848698804904215535020","94985156930797785515687696151323669870","215130344324707041168855055689814716577","149444718171788907227940664294514945932","283109304772066993894798419244945953654","75540971250215794128160525218375513470","79184933469946688309994126175862956930","284370207654256253207498251055580374605","158764811638399078070390527706018330785","132960497475179756936280411028795213029","90231484915474161111665324090744072697","171434388312040294206175305564639900192","317051119088722702455309269789605940045","230375219837531452191070182776909129162","203429538992895337513326144881183564460","167553722907564739993014628430888159571","201734540577200677347955937809129639032","84837435922442434991123958438193803019","332329815085618130380038266150578484591","231641427403628256543074046836237567694","285632608063057880088894693718025176312","72957773220694104424787652424373743582","276658915807023810039989049567380792692","310914620801247333527217062202233634882","29596156925072181809153800740039148252","326618135817771068816859199940112541631","132373818188828183485415184249574358212","162270660663605029679584607000692223331","223880047302031816845651769514361294768","135582123997148526978912225769921059129","94682963605914528154339593602898404304","294781077198013897192040493756506891373","162107980502403396874032718139266553473","213717078337946846992035212692571629749","329290485897673505570119194292763190506","85005565345317875519306389160181804954","103008366326069690208917903507325086265","291842477210511642350752805904168934404","335509452559260605908244674348832981680","312074861960969291741538384139257579035","256383471407669284505191812758180168435","16851598889783919493885661792046389938"]}},{"id":"ASB-A-151644303-e08b6140","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"function":"NuPlayerDriver::updateMetrics","file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp"},"deprecated":false,"digest":{"function_hash":"19970835269334683979683547178283901791","length":2130}},{"target":{"function":"NuPlayerDriver::getParameter","file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp"},"deprecated":false,"digest":{"length":257,"function_hash":"284467511168557220306610799003606564379"},"id":"ASB-A-151644303-f4a1b189","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52"}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/36a66d535b38245d386f2b5fd3ffbdcbbd0f3289","https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52"],"severity":"High","spl":"2020-08-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-151644303.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2020-08-01"}]}],"versions":["10"],"ecosystem_specific":{"spl":"2020-08-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.h"},"deprecated":false,"digest":{"line_hashes":["285693742590668977864572485398167092788","163354062488960643812532540975635500944","149807217642544446754387382624414796857","122005495037328633938150858824226178426"],"threshold":0.9},"id":"ASB-A-151644303-0dff7818"},{"digest":{"threshold":0.9,"line_hashes":["68762050946771697909153949919300292353","115136153507478749229531670102787782968","57975181769065734848698804904215535020","94985156930797785515687696151323669870","215130344324707041168855055689814716577","149444718171788907227940664294514945932","283109304772066993894798419244945953654","75540971250215794128160525218375513470","79184933469946688309994126175862956930","284370207654256253207498251055580374605","158764811638399078070390527706018330785","132960497475179756936280411028795213029","90231484915474161111665324090744072697","171434388312040294206175305564639900192","317051119088722702455309269789605940045","230375219837531452191070182776909129162","203429538992895337513326144881183564460","167553722907564739993014628430888159571","201734540577200677347955937809129639032","84837435922442434991123958438193803019","332329815085618130380038266150578484591","231641427403628256543074046836237567694","285632608063057880088894693718025176312","72957773220694104424787652424373743582","276658915807023810039989049567380792692","310914620801247333527217062202233634882","29596156925072181809153800740039148252","326618135817771068816859199940112541631","132373818188828183485415184249574358212","162270660663605029679584607000692223331","223880047302031816845651769514361294768","135582123997148526978912225769921059129","94682963605914528154339593602898404304","294781077198013897192040493756506891373","162107980502403396874032718139266553473","213717078337946846992035212692571629749","329290485897673505570119194292763190506","85005565345317875519306389160181804954","103008366326069690208917903507325086265","291842477210511642350752805904168934404","335509452559260605908244674348832981680","312074861960969291741538384139257579035","256383471407669284505191812758180168435","16851598889783919493885661792046389938"]},"id":"ASB-A-151644303-561ed419","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp"},"deprecated":false},{"digest":{"function_hash":"284467511168557220306610799003606564379","length":257},"id":"ASB-A-151644303-56b003c2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::getParameter"},"deprecated":false},{"target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::logMetrics"},"deprecated":false,"digest":{"function_hash":"16733455476364751386489623831865073483","length":594},"id":"ASB-A-151644303-666e5814","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::~NuPlayerDriver"},"deprecated":false,"digest":{"function_hash":"119514076358916030166398816307305096955","length":245},"id":"ASB-A-151644303-73803652","signature_type":"Function"},{"deprecated":false,"digest":{"length":181,"function_hash":"229611388859470585784565905170352380863"},"id":"ASB-A-151644303-d0375e91","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::setUID"}},{"source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"function":"NuPlayerDriver::updateMetrics","file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp"},"deprecated":false,"digest":{"function_hash":"19970835269334683979683547178283901791","length":2130},"id":"ASB-A-151644303-dfef53e5","signature_type":"Function","signature_version":"v1"},{"id":"ASB-A-151644303-fef864b9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::notifyListener_l"},"deprecated":false,"digest":{"function_hash":"338517978009753270771075971955006194024","length":1372}}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/36a66d535b38245d386f2b5fd3ffbdcbbd0f3289","https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-151644303.json"}}],"schema_version":"1.9.0"}