{"id":"ASB-A-151644303","details":"In clearPropValue of MediaAnalyticsItem.cpp, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the media server with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-151644303","CVE-2020-0243"],"modified":"2026-05-22T15:55:21.353668239Z","published":"2020-08-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2020-08-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/av/+/36a66d535b38245d386f2b5fd3ffbdcbbd0f3289"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52"}],"affected":[{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0:0"},{"fixed":"8.0:2020-08-01"}]}],"versions":["8.0"],"ecosystem_specific":{"spl":"2020-08-01","vanir_signatures":[{"digest":{"function_hash":"119514076358916030166398816307305096955","length":245},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::~NuPlayerDriver"},"signature_type":"Function","id":"ASB-A-151644303-1a868f09","deprecated":false},{"digest":{"function_hash":"19970835269334683979683547178283901791","length":2130},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::updateMetrics"},"signature_type":"Function","id":"ASB-A-151644303-614cb9fb","deprecated":false},{"digest":{"function_hash":"16733455476364751386489623831865073483","length":594},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::logMetrics"},"signature_type":"Function","id":"ASB-A-151644303-66081494","deprecated":false},{"digest":{"function_hash":"229611388859470585784565905170352380863","length":181},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::setUID"},"signature_type":"Function","id":"ASB-A-151644303-92f3590f","deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["285693742590668977864572485398167092788","163354062488960643812532540975635500944","149807217642544446754387382624414796857","122005495037328633938150858824226178426"]},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.h"},"signature_type":"Line","id":"ASB-A-151644303-a6c8ee1f","deprecated":false},{"digest":{"function_hash":"338517978009753270771075971955006194024","length":1372},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::notifyListener_l"},"signature_type":"Function","id":"ASB-A-151644303-cd553dfd","deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["68762050946771697909153949919300292353","115136153507478749229531670102787782968","57975181769065734848698804904215535020","94985156930797785515687696151323669870","215130344324707041168855055689814716577","149444718171788907227940664294514945932","283109304772066993894798419244945953654","75540971250215794128160525218375513470","79184933469946688309994126175862956930","284370207654256253207498251055580374605","158764811638399078070390527706018330785","132960497475179756936280411028795213029","90231484915474161111665324090744072697","171434388312040294206175305564639900192","317051119088722702455309269789605940045","230375219837531452191070182776909129162","203429538992895337513326144881183564460","167553722907564739993014628430888159571","201734540577200677347955937809129639032","84837435922442434991123958438193803019","332329815085618130380038266150578484591","231641427403628256543074046836237567694","285632608063057880088894693718025176312","72957773220694104424787652424373743582","276658915807023810039989049567380792692","310914620801247333527217062202233634882","29596156925072181809153800740039148252","326618135817771068816859199940112541631","132373818188828183485415184249574358212","162270660663605029679584607000692223331","223880047302031816845651769514361294768","135582123997148526978912225769921059129","94682963605914528154339593602898404304","294781077198013897192040493756506891373","162107980502403396874032718139266553473","213717078337946846992035212692571629749","329290485897673505570119194292763190506","85005565345317875519306389160181804954","103008366326069690208917903507325086265","291842477210511642350752805904168934404","335509452559260605908244674348832981680","312074861960969291741538384139257579035","256383471407669284505191812758180168435","16851598889783919493885661792046389938"]},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp"},"signature_type":"Line","id":"ASB-A-151644303-d43e41cd","deprecated":false},{"digest":{"function_hash":"284467511168557220306610799003606564379","length":257},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::getParameter"},"signature_type":"Function","deprecated":false,"id":"ASB-A-151644303-e2b472e6"}],"types":["EoP"],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/36a66d535b38245d386f2b5fd3ffbdcbbd0f3289","https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-151644303.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1:0"},{"fixed":"8.1:2020-08-01"}]}],"versions":["8.1"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"119514076358916030166398816307305096955","length":245},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"function":"NuPlayerDriver::~NuPlayerDriver","file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp"},"signature_type":"Function","deprecated":false,"id":"ASB-A-151644303-07b59800"},{"digest":{"function_hash":"16733455476364751386489623831865073483","length":594},"signature_version":"v1","signature_type":"Function","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::logMetrics"},"source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","id":"ASB-A-151644303-41b89128","deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["285693742590668977864572485398167092788","163354062488960643812532540975635500944","149807217642544446754387382624414796857","122005495037328633938150858824226178426"]},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.h"},"signature_type":"Line","id":"ASB-A-151644303-5527fbcc","deprecated":false},{"digest":{"function_hash":"338517978009753270771075971955006194024","length":1372},"signature_version":"v1","signature_type":"Function","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::notifyListener_l"},"source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","id":"ASB-A-151644303-8ddba030","deprecated":false},{"digest":{"function_hash":"229611388859470585784565905170352380863","length":181},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::setUID"},"signature_type":"Function","id":"ASB-A-151644303-9e77a067","deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["68762050946771697909153949919300292353","115136153507478749229531670102787782968","57975181769065734848698804904215535020","94985156930797785515687696151323669870","215130344324707041168855055689814716577","149444718171788907227940664294514945932","283109304772066993894798419244945953654","75540971250215794128160525218375513470","79184933469946688309994126175862956930","284370207654256253207498251055580374605","158764811638399078070390527706018330785","132960497475179756936280411028795213029","90231484915474161111665324090744072697","171434388312040294206175305564639900192","317051119088722702455309269789605940045","230375219837531452191070182776909129162","203429538992895337513326144881183564460","167553722907564739993014628430888159571","201734540577200677347955937809129639032","84837435922442434991123958438193803019","332329815085618130380038266150578484591","231641427403628256543074046836237567694","285632608063057880088894693718025176312","72957773220694104424787652424373743582","276658915807023810039989049567380792692","310914620801247333527217062202233634882","29596156925072181809153800740039148252","326618135817771068816859199940112541631","132373818188828183485415184249574358212","162270660663605029679584607000692223331","223880047302031816845651769514361294768","135582123997148526978912225769921059129","94682963605914528154339593602898404304","294781077198013897192040493756506891373","162107980502403396874032718139266553473","213717078337946846992035212692571629749","329290485897673505570119194292763190506","85005565345317875519306389160181804954","103008366326069690208917903507325086265","291842477210511642350752805904168934404","335509452559260605908244674348832981680","312074861960969291741538384139257579035","256383471407669284505191812758180168435","16851598889783919493885661792046389938"]},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp"},"signature_type":"Line","deprecated":false,"id":"ASB-A-151644303-aa9ed9ba"},{"digest":{"function_hash":"284467511168557220306610799003606564379","length":257},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"function":"NuPlayerDriver::getParameter","file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp"},"signature_type":"Function","deprecated":false,"id":"ASB-A-151644303-b48a8970"},{"digest":{"function_hash":"19970835269334683979683547178283901791","length":2130},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::updateMetrics"},"signature_type":"Function","deprecated":false,"id":"ASB-A-151644303-dd56f3fa"}],"spl":"2020-08-01","fixes":["https://android.googlesource.com/platform/frameworks/av/+/36a66d535b38245d386f2b5fd3ffbdcbbd0f3289","https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-151644303.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9:0"},{"fixed":"9:2020-08-01"}]}],"versions":["9"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"119514076358916030166398816307305096955","length":245},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::~NuPlayerDriver"},"signature_type":"Function","id":"ASB-A-151644303-2ba22008","deprecated":false},{"digest":{"function_hash":"16733455476364751386489623831865073483","length":594},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::logMetrics"},"signature_type":"Function","deprecated":false,"id":"ASB-A-151644303-4a87abec"},{"digest":{"function_hash":"229611388859470585784565905170352380863","length":181},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::setUID"},"signature_type":"Function","deprecated":false,"id":"ASB-A-151644303-87f49ea6"},{"digest":{"threshold":0.9,"line_hashes":["285693742590668977864572485398167092788","163354062488960643812532540975635500944","149807217642544446754387382624414796857","122005495037328633938150858824226178426"]},"signature_version":"v1","signature_type":"Line","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.h"},"source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","id":"ASB-A-151644303-a06deb34","deprecated":false},{"digest":{"function_hash":"338517978009753270771075971955006194024","length":1372},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::notifyListener_l"},"signature_type":"Function","deprecated":false,"id":"ASB-A-151644303-bf097827"},{"digest":{"threshold":0.9,"line_hashes":["68762050946771697909153949919300292353","115136153507478749229531670102787782968","57975181769065734848698804904215535020","94985156930797785515687696151323669870","215130344324707041168855055689814716577","149444718171788907227940664294514945932","283109304772066993894798419244945953654","75540971250215794128160525218375513470","79184933469946688309994126175862956930","284370207654256253207498251055580374605","158764811638399078070390527706018330785","132960497475179756936280411028795213029","90231484915474161111665324090744072697","171434388312040294206175305564639900192","317051119088722702455309269789605940045","230375219837531452191070182776909129162","203429538992895337513326144881183564460","167553722907564739993014628430888159571","201734540577200677347955937809129639032","84837435922442434991123958438193803019","332329815085618130380038266150578484591","231641427403628256543074046836237567694","285632608063057880088894693718025176312","72957773220694104424787652424373743582","276658915807023810039989049567380792692","310914620801247333527217062202233634882","29596156925072181809153800740039148252","326618135817771068816859199940112541631","132373818188828183485415184249574358212","162270660663605029679584607000692223331","223880047302031816845651769514361294768","135582123997148526978912225769921059129","94682963605914528154339593602898404304","294781077198013897192040493756506891373","162107980502403396874032718139266553473","213717078337946846992035212692571629749","329290485897673505570119194292763190506","85005565345317875519306389160181804954","103008366326069690208917903507325086265","291842477210511642350752805904168934404","335509452559260605908244674348832981680","312074861960969291741538384139257579035","256383471407669284505191812758180168435","16851598889783919493885661792046389938"]},"signature_version":"v1","signature_type":"Line","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp"},"source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","id":"ASB-A-151644303-cd5dd994","deprecated":false},{"digest":{"function_hash":"19970835269334683979683547178283901791","length":2130},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::updateMetrics"},"signature_type":"Function","deprecated":false,"id":"ASB-A-151644303-e08b6140"},{"digest":{"function_hash":"284467511168557220306610799003606564379","length":257},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::getParameter"},"signature_type":"Function","id":"ASB-A-151644303-f4a1b189","deprecated":false}],"spl":"2020-08-01","fixes":["https://android.googlesource.com/platform/frameworks/av/+/36a66d535b38245d386f2b5fd3ffbdcbbd0f3289","https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-151644303.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2020-08-01"}]}],"versions":["10"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["285693742590668977864572485398167092788","163354062488960643812532540975635500944","149807217642544446754387382624414796857","122005495037328633938150858824226178426"]},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.h"},"signature_type":"Line","deprecated":false,"id":"ASB-A-151644303-0dff7818"},{"digest":{"threshold":0.9,"line_hashes":["68762050946771697909153949919300292353","115136153507478749229531670102787782968","57975181769065734848698804904215535020","94985156930797785515687696151323669870","215130344324707041168855055689814716577","149444718171788907227940664294514945932","283109304772066993894798419244945953654","75540971250215794128160525218375513470","79184933469946688309994126175862956930","284370207654256253207498251055580374605","158764811638399078070390527706018330785","132960497475179756936280411028795213029","90231484915474161111665324090744072697","171434388312040294206175305564639900192","317051119088722702455309269789605940045","230375219837531452191070182776909129162","203429538992895337513326144881183564460","167553722907564739993014628430888159571","201734540577200677347955937809129639032","84837435922442434991123958438193803019","332329815085618130380038266150578484591","231641427403628256543074046836237567694","285632608063057880088894693718025176312","72957773220694104424787652424373743582","276658915807023810039989049567380792692","310914620801247333527217062202233634882","29596156925072181809153800740039148252","326618135817771068816859199940112541631","132373818188828183485415184249574358212","162270660663605029679584607000692223331","223880047302031816845651769514361294768","135582123997148526978912225769921059129","94682963605914528154339593602898404304","294781077198013897192040493756506891373","162107980502403396874032718139266553473","213717078337946846992035212692571629749","329290485897673505570119194292763190506","85005565345317875519306389160181804954","103008366326069690208917903507325086265","291842477210511642350752805904168934404","335509452559260605908244674348832981680","312074861960969291741538384139257579035","256383471407669284505191812758180168435","16851598889783919493885661792046389938"]},"signature_version":"v1","signature_type":"Line","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp"},"source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","id":"ASB-A-151644303-561ed419","deprecated":false},{"digest":{"function_hash":"284467511168557220306610799003606564379","length":257},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::getParameter"},"signature_type":"Function","deprecated":false,"id":"ASB-A-151644303-56b003c2"},{"digest":{"function_hash":"16733455476364751386489623831865073483","length":594},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::logMetrics"},"signature_type":"Function","id":"ASB-A-151644303-666e5814","deprecated":false},{"digest":{"function_hash":"119514076358916030166398816307305096955","length":245},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::~NuPlayerDriver"},"signature_type":"Function","deprecated":false,"id":"ASB-A-151644303-73803652"},{"digest":{"function_hash":"229611388859470585784565905170352380863","length":181},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::setUID"},"signature_type":"Function","deprecated":false,"id":"ASB-A-151644303-d0375e91"},{"digest":{"function_hash":"19970835269334683979683547178283901791","length":2130},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::updateMetrics"},"signature_type":"Function","id":"ASB-A-151644303-dfef53e5","deprecated":false},{"digest":{"function_hash":"338517978009753270771075971955006194024","length":1372},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52","target":{"file":"media/libmediaplayerservice/nuplayer/NuPlayerDriver.cpp","function":"NuPlayerDriver::notifyListener_l"},"signature_type":"Function","id":"ASB-A-151644303-fef864b9","deprecated":false}],"spl":"2020-08-01","fixes":["https://android.googlesource.com/platform/frameworks/av/+/36a66d535b38245d386f2b5fd3ffbdcbbd0f3289","https://android.googlesource.com/platform/frameworks/av/+/e5767553f55fb30d9d58ba211ec68e64a6266e52"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-151644303.json"}}],"schema_version":"1.7.5"}