{"id":"ASB-A-168211968","details":"In appendEventsToCacheLocked of SensorEventConnection.cpp, there is a possible out of bounds write due to a use-after-free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-168211968","CVE-2021-0318"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2021-01-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2021-01-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b"}],"affected":[{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1:0"},{"fixed":"8.1:2021-01-01"}]}],"versions":["8.1"],"ecosystem_specific":{"spl":"2021-01-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/sensorservice/SensorEventConnection.cpp"},"deprecated":false,"digest":{"line_hashes":["202368162637071165403492011988823194783","121104729448867220595608183493770835687","293483056608763997962834505626895548119","142822261472916088772458385887388879543","54688159848720015509561153431329904789","4277870523749451347662473076295229414","300306834319706072564686893329399314156","288508651323435783821469633011772846326","278248246036607606048281863112930083024","226599680908214427281814260888099075190","67674543247936684167742947757204455558","151215926628002863242663729258108071898","15069736780096551286450254408379903251","89204402314811274667127098496563295789","118836781511721118979551795024603328147","48624523166459769892248248668580047688","61120592048590206267109638804359711989","20894016542014276904274705222809748103","160387362135192214326949618991660477992","302123035189751588749838170976561479386","207251469058233223588979060847798748666","260197688206117516574268416906806434397","270188350052514123047402395743758234257","55970111288830492236382369679935355198","43937621687462578598029918613112041832"],"threshold":0.9},"id":"ASB-A-168211968-4b6f40e8","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b"},{"id":"ASB-A-168211968-62f2b0e7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b","target":{"file":"services/sensorservice/SensorEventConnection.cpp","function":"SensorService::SensorEventConnection::enableDisable"},"deprecated":false,"digest":{"function_hash":"33931799434306739723823299059545368450","length":318}},{"deprecated":false,"digest":{"length":170,"function_hash":"137297107811361477517210085125065757025"},"id":"ASB-A-168211968-90c6ba15","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b","target":{"file":"services/sensorservice/SensorEventConnection.cpp","function":"SensorService::SensorEventConnection::setEventRate"}},{"id":"ASB-A-168211968-baf98c7d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b","target":{"function":"SensorService::SensorEventConnection::destroy","file":"services/sensorservice/SensorEventConnection.cpp"},"deprecated":false,"digest":{"length":243,"function_hash":"225963280910332089164664548448213960643"}},{"id":"ASB-A-168211968-c58b8bc2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b","target":{"function":"SensorService::SensorEventConnection::~SensorEventConnection","file":"services/sensorservice/SensorEventConnection.cpp"},"deprecated":false,"digest":{"length":158,"function_hash":"125560433277978335678868205680761343141"}},{"digest":{"function_hash":"169200356894306624094865171954097805256","length":120},"id":"ASB-A-168211968-c98dc41f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b","target":{"function":"SensorService::SensorEventConnection::flush","file":"services/sensorservice/SensorEventConnection.cpp"},"deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["122281379492002828810663692672006764002","171645295499317909613465543532018460138","176544860176600423777909228970737669623","254183565615526321487899148978979568729","928524509260589180792834089856723854","68702381720170381707297165040800976011"]},"id":"ASB-A-168211968-ccdd5905","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b","target":{"file":"services/sensorservice/SensorEventConnection.h"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-168211968.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9:0"},{"fixed":"9:2021-01-01"}]}],"versions":["9"],"ecosystem_specific":{"spl":"2021-01-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b","target":{"function":"SensorService::SensorEventConnection::~SensorEventConnection","file":"services/sensorservice/SensorEventConnection.cpp"},"deprecated":false,"digest":{"length":158,"function_hash":"125560433277978335678868205680761343141"},"id":"ASB-A-168211968-47586f18","signature_type":"Function"},{"target":{"file":"services/sensorservice/SensorEventConnection.cpp","function":"SensorService::SensorEventConnection::destroy"},"deprecated":false,"digest":{"function_hash":"225963280910332089164664548448213960643","length":243},"id":"ASB-A-168211968-721ac9b3","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b","target":{"file":"services/sensorservice/SensorEventConnection.cpp"},"deprecated":false,"digest":{"line_hashes":["202368162637071165403492011988823194783","121104729448867220595608183493770835687","293483056608763997962834505626895548119","142822261472916088772458385887388879543","54688159848720015509561153431329904789","4277870523749451347662473076295229414","300306834319706072564686893329399314156","288508651323435783821469633011772846326","278248246036607606048281863112930083024","226599680908214427281814260888099075190","67674543247936684167742947757204455558","151215926628002863242663729258108071898","15069736780096551286450254408379903251","89204402314811274667127098496563295789","118836781511721118979551795024603328147","48624523166459769892248248668580047688","61120592048590206267109638804359711989","20894016542014276904274705222809748103","160387362135192214326949618991660477992","302123035189751588749838170976561479386","207251469058233223588979060847798748666","260197688206117516574268416906806434397","270188350052514123047402395743758234257","55970111288830492236382369679935355198","43937621687462578598029918613112041832"],"threshold":0.9},"id":"ASB-A-168211968-846c4cee"},{"digest":{"length":120,"function_hash":"169200356894306624094865171954097805256"},"id":"ASB-A-168211968-9f300c16","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b","target":{"file":"services/sensorservice/SensorEventConnection.cpp","function":"SensorService::SensorEventConnection::flush"},"deprecated":false},{"id":"ASB-A-168211968-aa30693f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b","target":{"file":"services/sensorservice/SensorEventConnection.h"},"deprecated":false,"digest":{"line_hashes":["122281379492002828810663692672006764002","171645295499317909613465543532018460138","176544860176600423777909228970737669623","254183565615526321487899148978979568729","928524509260589180792834089856723854","68702381720170381707297165040800976011"],"threshold":0.9}},{"id":"ASB-A-168211968-ce35a513","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b","target":{"function":"SensorService::SensorEventConnection::setEventRate","file":"services/sensorservice/SensorEventConnection.cpp"},"deprecated":false,"digest":{"function_hash":"137297107811361477517210085125065757025","length":170}},{"target":{"file":"services/sensorservice/SensorEventConnection.cpp","function":"SensorService::SensorEventConnection::enableDisable"},"deprecated":false,"digest":{"function_hash":"33931799434306739723823299059545368450","length":318},"id":"ASB-A-168211968-e9813f10","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b"}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-168211968.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2021-01-01"}]}],"versions":["10"],"ecosystem_specific":{"severity":"High","spl":"2021-01-01","types":["EoP"],"vanir_signatures":[{"target":{"function":"SensorService::SensorEventConnection::flush","file":"services/sensorservice/SensorEventConnection.cpp"},"deprecated":false,"digest":{"length":120,"function_hash":"169200356894306624094865171954097805256"},"id":"ASB-A-168211968-0023f1b5","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b","target":{"file":"services/sensorservice/SensorEventConnection.cpp","function":"SensorService::SensorEventConnection::~SensorEventConnection"},"deprecated":false,"digest":{"function_hash":"125560433277978335678868205680761343141","length":158},"id":"ASB-A-168211968-02e25bc4","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b","target":{"file":"services/sensorservice/SensorEventConnection.cpp","function":"SensorService::SensorEventConnection::enableDisable"},"deprecated":false,"digest":{"function_hash":"33931799434306739723823299059545368450","length":318},"id":"ASB-A-168211968-2d80f79e","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b","target":{"file":"services/sensorservice/SensorEventConnection.cpp","function":"SensorService::SensorEventConnection::destroy"},"deprecated":false,"digest":{"length":243,"function_hash":"225963280910332089164664548448213960643"},"id":"ASB-A-168211968-7baf05ec","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b","target":{"function":"SensorService::SensorEventConnection::setEventRate","file":"services/sensorservice/SensorEventConnection.cpp"},"deprecated":false,"digest":{"function_hash":"137297107811361477517210085125065757025","length":170},"id":"ASB-A-168211968-855f879c","signature_type":"Function"},{"id":"ASB-A-168211968-8c46c682","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b","target":{"file":"services/sensorservice/SensorEventConnection.h"},"deprecated":false,"digest":{"line_hashes":["122281379492002828810663692672006764002","171645295499317909613465543532018460138","176544860176600423777909228970737669623","254183565615526321487899148978979568729","928524509260589180792834089856723854","68702381720170381707297165040800976011"],"threshold":0.9}},{"id":"ASB-A-168211968-97aae3e9","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b","target":{"file":"services/sensorservice/SensorEventConnection.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["202368162637071165403492011988823194783","121104729448867220595608183493770835687","293483056608763997962834505626895548119","142822261472916088772458385887388879543","54688159848720015509561153431329904789","4277870523749451347662473076295229414","300306834319706072564686893329399314156","288508651323435783821469633011772846326","278248246036607606048281863112930083024","226599680908214427281814260888099075190","67674543247936684167742947757204455558","151215926628002863242663729258108071898","15069736780096551286450254408379903251","89204402314811274667127098496563295789","118836781511721118979551795024603328147","48624523166459769892248248668580047688","61120592048590206267109638804359711989","20894016542014276904274705222809748103","160387362135192214326949618991660477992","302123035189751588749838170976561479386","207251469058233223588979060847798748666","260197688206117516574268416906806434397","270188350052514123047402395743758234257","55970111288830492236382369679935355198","43937621687462578598029918613112041832"]}}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-168211968.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2021-01-01"}]}],"versions":["11"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b"],"severity":"High","spl":"2021-01-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-168211968-2edb8018","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b","target":{"file":"services/sensorservice/SensorEventConnection.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["122281379492002828810663692672006764002","171645295499317909613465543532018460138","176544860176600423777909228970737669623","254183565615526321487899148978979568729","928524509260589180792834089856723854","68702381720170381707297165040800976011"]}},{"source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b","target":{"file":"services/sensorservice/SensorEventConnection.cpp","function":"SensorService::SensorEventConnection::setEventRate"},"deprecated":false,"digest":{"function_hash":"137297107811361477517210085125065757025","length":170},"id":"ASB-A-168211968-31b2d87b","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"125560433277978335678868205680761343141","length":158},"id":"ASB-A-168211968-3b471301","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b","target":{"function":"SensorService::SensorEventConnection::~SensorEventConnection","file":"services/sensorservice/SensorEventConnection.cpp"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b","target":{"file":"services/sensorservice/SensorEventConnection.cpp"},"deprecated":false,"digest":{"line_hashes":["202368162637071165403492011988823194783","121104729448867220595608183493770835687","293483056608763997962834505626895548119","142822261472916088772458385887388879543","54688159848720015509561153431329904789","4277870523749451347662473076295229414","300306834319706072564686893329399314156","288508651323435783821469633011772846326","278248246036607606048281863112930083024","226599680908214427281814260888099075190","67674543247936684167742947757204455558","151215926628002863242663729258108071898","15069736780096551286450254408379903251","89204402314811274667127098496563295789","118836781511721118979551795024603328147","48624523166459769892248248668580047688","61120592048590206267109638804359711989","20894016542014276904274705222809748103","160387362135192214326949618991660477992","302123035189751588749838170976561479386","207251469058233223588979060847798748666","260197688206117516574268416906806434397","270188350052514123047402395743758234257","55970111288830492236382369679935355198","43937621687462578598029918613112041832"],"threshold":0.9},"id":"ASB-A-168211968-8567af1e","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b","target":{"file":"services/sensorservice/SensorEventConnection.cpp","function":"SensorService::SensorEventConnection::destroy"},"deprecated":false,"digest":{"length":243,"function_hash":"225963280910332089164664548448213960643"},"id":"ASB-A-168211968-9746f222","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b","target":{"function":"SensorService::SensorEventConnection::enableDisable","file":"services/sensorservice/SensorEventConnection.cpp"},"deprecated":false,"digest":{"function_hash":"33931799434306739723823299059545368450","length":318},"id":"ASB-A-168211968-a3e80b35"},{"target":{"file":"services/sensorservice/SensorEventConnection.cpp","function":"SensorService::SensorEventConnection::flush"},"deprecated":false,"digest":{"function_hash":"169200356894306624094865171954097805256","length":120},"id":"ASB-A-168211968-d0fc6c94","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/adb416ac460cb28ca03e7898bdd154b1d0f8c16b"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-168211968.json"}}],"schema_version":"1.9.0"}