{"id":"ASB-A-161894517","details":"In appendFormatV of String8.cpp, there is a possible out of bounds write due to incorrect error handling. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-161894517","CVE-2020-0421"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2020-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2020-10-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/system/core/+/bad50ed24f9d48d001fcedd332d59f162dc3432d"}],"affected":[{"package":{"name":"platform/system/core","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0:0"},{"fixed":"8.0:2020-10-01"}]}],"versions":["8.0"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/core/+/bad50ed24f9d48d001fcedd332d59f162dc3432d"],"severity":"High","spl":"2020-10-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-161894517-25c794ef","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/bad50ed24f9d48d001fcedd332d59f162dc3432d","target":{"file":"libutils/String8.cpp"},"deprecated":false,"digest":{"line_hashes":["179724582368432587449024339023966956690","125373090127878909928384078389237341639","215776864378662469997514373978846441973","221157752089847403538202464558933860083","184377021692256145058180548104623777372"],"threshold":0.9}},{"id":"ASB-A-161894517-261e69eb","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/bad50ed24f9d48d001fcedd332d59f162dc3432d","target":{"file":"libutils/String8.cpp","function":"String8::appendFormatV"},"deprecated":false,"digest":{"function_hash":"99346198394436472594005213147588571161","length":392}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-161894517.json"}},{"package":{"name":"platform/system/core","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1:0"},{"fixed":"8.1:2020-10-01"}]}],"versions":["8.1"],"ecosystem_specific":{"severity":"High","spl":"2020-10-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-161894517-1caba8b0","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/bad50ed24f9d48d001fcedd332d59f162dc3432d","target":{"file":"libutils/String8.cpp"},"deprecated":false,"digest":{"line_hashes":["179724582368432587449024339023966956690","125373090127878909928384078389237341639","215776864378662469997514373978846441973","221157752089847403538202464558933860083","184377021692256145058180548104623777372"],"threshold":0.9}},{"digest":{"function_hash":"99346198394436472594005213147588571161","length":392},"id":"ASB-A-161894517-3e329e8d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/bad50ed24f9d48d001fcedd332d59f162dc3432d","target":{"file":"libutils/String8.cpp","function":"String8::appendFormatV"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/system/core/+/bad50ed24f9d48d001fcedd332d59f162dc3432d"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-161894517.json"}},{"package":{"name":"platform/system/core","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9:0"},{"fixed":"9:2020-10-01"}]}],"versions":["9"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["179724582368432587449024339023966956690","125373090127878909928384078389237341639","215776864378662469997514373978846441973","221157752089847403538202464558933860083","184377021692256145058180548104623777372"]},"id":"ASB-A-161894517-7d10a44a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/bad50ed24f9d48d001fcedd332d59f162dc3432d","target":{"file":"libutils/String8.cpp"}},{"deprecated":false,"digest":{"function_hash":"99346198394436472594005213147588571161","length":392},"id":"ASB-A-161894517-e3f1253c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/bad50ed24f9d48d001fcedd332d59f162dc3432d","target":{"function":"String8::appendFormatV","file":"libutils/String8.cpp"}}],"fixes":["https://android.googlesource.com/platform/system/core/+/bad50ed24f9d48d001fcedd332d59f162dc3432d"],"severity":"High","spl":"2020-10-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-161894517.json"}},{"package":{"name":"platform/system/core","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2020-10-01"}]}],"versions":["10"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["179724582368432587449024339023966956690","125373090127878909928384078389237341639","215776864378662469997514373978846441973","221157752089847403538202464558933860083","184377021692256145058180548104623777372"]},"id":"ASB-A-161894517-1459d120","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/bad50ed24f9d48d001fcedd332d59f162dc3432d","target":{"file":"libutils/String8.cpp"},"deprecated":false},{"source":"https://android.googlesource.com/platform/system/core/+/bad50ed24f9d48d001fcedd332d59f162dc3432d","target":{"function":"String8::appendFormatV","file":"libutils/String8.cpp"},"deprecated":false,"digest":{"length":392,"function_hash":"99346198394436472594005213147588571161"},"id":"ASB-A-161894517-3e4a6850","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/system/core/+/bad50ed24f9d48d001fcedd332d59f162dc3432d"],"severity":"High","spl":"2020-10-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-161894517.json"}},{"package":{"name":"platform/system/core","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2020-10-01"}]}],"versions":["11"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/bad50ed24f9d48d001fcedd332d59f162dc3432d","target":{"file":"libutils/String8.cpp"},"deprecated":false,"digest":{"line_hashes":["179724582368432587449024339023966956690","125373090127878909928384078389237341639","215776864378662469997514373978846441973","221157752089847403538202464558933860083","184377021692256145058180548104623777372"],"threshold":0.9},"id":"ASB-A-161894517-0b0b98a4","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/bad50ed24f9d48d001fcedd332d59f162dc3432d","target":{"file":"libutils/String8.cpp","function":"String8::appendFormatV"},"deprecated":false,"digest":{"function_hash":"99346198394436472594005213147588571161","length":392},"id":"ASB-A-161894517-178da2c0"}],"fixes":["https://android.googlesource.com/platform/system/core/+/bad50ed24f9d48d001fcedd332d59f162dc3432d"],"severity":"High","spl":"2020-10-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-161894517.json"}}],"schema_version":"1.9.0"}