{"id":"ASB-A-170732441","details":"In add_user_ce and remove_user_ce of storaged.cpp, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in storaged with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-170732441","CVE-2021-0330"],"modified":"2026-05-29T15:55:33.750044621Z","published":"2021-02-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2021-02-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"}],"affected":[{"package":{"name":"platform/system/core","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0:0"},{"fixed":"8.0:2021-02-01"}]}],"versions":["8.0"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"],"types":["EoP"],"spl":"2021-02-01","vanir_signatures":[{"signature_version":"v1","id":"ASB-A-170732441-3e541011","digest":{"length":170,"function_hash":"300167361355021078898744606461626013266"},"deprecated":false,"signature_type":"Function","target":{"file":"storaged/storaged.cpp","function":"storaged_t::remove_user_ce"},"source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"},{"signature_version":"v1","id":"ASB-A-170732441-44e4e2c0","digest":{"line_hashes":["148884704183119789745431446125644303789","151394682469363530294625898605493376541","86712825630336742764462619661373391625","232999621503221904690658452854100077325","280944976211515416952632778798809412816","319553659973294052510510398102967269421","279763494788592645457356422232975329263","118097696570985643310754771158743482698","223571053578481352040738937081701268036","230572787833601786447707060666103537776","294362824485928731244488060198716116015","237469369776047100256795032972842369864"],"threshold":0.9},"deprecated":false,"signature_type":"Line","target":{"file":"storaged/storaged.cpp"},"source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"},{"signature_version":"v1","id":"ASB-A-170732441-66204d59","digest":{"length":140,"function_hash":"167519093048703228946247534411643595271"},"deprecated":false,"signature_type":"Function","target":{"file":"storaged/storaged.cpp","function":"storaged_t::add_user_ce"},"source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"},{"signature_type":"Line","id":"ASB-A-170732441-dd16adc0","digest":{"line_hashes":["333093573110175335429488746125791417920","24018071451441426132691213514785838416","86157176319259806533313412164058622231","209717233212138300468968030045070510455"],"threshold":0.9},"deprecated":false,"target":{"file":"storaged/include/storaged.h"},"source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","signature_version":"v1","digest":{"length":167,"function_hash":"231865747446807252932323662572475155023"},"deprecated":false,"target":{"file":"storaged/storaged.cpp","function":"storaged_t::flush_protos"},"signature_type":"Function","id":"ASB-A-170732441-e1a66dcc"}],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-170732441.json"}},{"package":{"name":"platform/system/core","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1:0"},{"fixed":"8.1:2021-02-01"}]}],"versions":["8.1"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"],"types":["EoP"],"spl":"2021-02-01","vanir_signatures":[{"id":"ASB-A-170732441-0796c768","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","digest":{"line_hashes":["148884704183119789745431446125644303789","151394682469363530294625898605493376541","86712825630336742764462619661373391625","232999621503221904690658452854100077325","280944976211515416952632778798809412816","319553659973294052510510398102967269421","279763494788592645457356422232975329263","118097696570985643310754771158743482698","223571053578481352040738937081701268036","230572787833601786447707060666103537776","294362824485928731244488060198716116015","237469369776047100256795032972842369864"],"threshold":0.9},"deprecated":false,"target":{"file":"storaged/storaged.cpp"},"signature_version":"v1","signature_type":"Line"},{"id":"ASB-A-170732441-7be477fa","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","digest":{"length":170,"function_hash":"300167361355021078898744606461626013266"},"deprecated":false,"target":{"file":"storaged/storaged.cpp","function":"storaged_t::remove_user_ce"},"signature_version":"v1","signature_type":"Function"},{"id":"ASB-A-170732441-9850fc47","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","digest":{"length":140,"function_hash":"167519093048703228946247534411643595271"},"deprecated":false,"target":{"file":"storaged/storaged.cpp","function":"storaged_t::add_user_ce"},"signature_version":"v1","signature_type":"Function"},{"signature_version":"v1","id":"ASB-A-170732441-c1598fd3","digest":{"line_hashes":["333093573110175335429488746125791417920","24018071451441426132691213514785838416","86157176319259806533313412164058622231","209717233212138300468968030045070510455"],"threshold":0.9},"deprecated":false,"signature_type":"Line","target":{"file":"storaged/include/storaged.h"},"source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"},{"source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","signature_version":"v1","digest":{"length":167,"function_hash":"231865747446807252932323662572475155023"},"deprecated":false,"signature_type":"Function","id":"ASB-A-170732441-cfa6677c","target":{"file":"storaged/storaged.cpp","function":"storaged_t::flush_protos"}}],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-170732441.json"}},{"package":{"name":"platform/system/core","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9:0"},{"fixed":"9:2021-02-01"}]}],"versions":["9"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"],"types":["EoP"],"spl":"2021-02-01","vanir_signatures":[{"id":"ASB-A-170732441-1158d785","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","digest":{"length":167,"function_hash":"231865747446807252932323662572475155023"},"deprecated":false,"target":{"file":"storaged/storaged.cpp","function":"storaged_t::flush_protos"},"signature_version":"v1","signature_type":"Function"},{"signature_version":"v1","id":"ASB-A-170732441-6c4bcf07","digest":{"length":170,"function_hash":"300167361355021078898744606461626013266"},"deprecated":false,"signature_type":"Function","target":{"file":"storaged/storaged.cpp","function":"storaged_t::remove_user_ce"},"source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"},{"source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","signature_version":"v1","digest":{"line_hashes":["333093573110175335429488746125791417920","24018071451441426132691213514785838416","86157176319259806533313412164058622231","209717233212138300468968030045070510455"],"threshold":0.9},"deprecated":false,"target":{"file":"storaged/include/storaged.h"},"signature_type":"Line","id":"ASB-A-170732441-ca352177"},{"signature_version":"v1","id":"ASB-A-170732441-e54179dd","digest":{"length":140,"function_hash":"167519093048703228946247534411643595271"},"deprecated":false,"signature_type":"Function","target":{"file":"storaged/storaged.cpp","function":"storaged_t::add_user_ce"},"source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"},{"source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","signature_version":"v1","digest":{"line_hashes":["148884704183119789745431446125644303789","151394682469363530294625898605493376541","86712825630336742764462619661373391625","232999621503221904690658452854100077325","280944976211515416952632778798809412816","319553659973294052510510398102967269421","279763494788592645457356422232975329263","118097696570985643310754771158743482698","223571053578481352040738937081701268036","230572787833601786447707060666103537776","294362824485928731244488060198716116015","237469369776047100256795032972842369864"],"threshold":0.9},"deprecated":false,"target":{"file":"storaged/storaged.cpp"},"signature_type":"Line","id":"ASB-A-170732441-f2c7691c"}],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-170732441.json"}},{"package":{"name":"platform/system/core","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2021-02-01"}]}],"versions":["10"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"],"types":["EoP"],"spl":"2021-02-01","vanir_signatures":[{"signature_version":"v1","id":"ASB-A-170732441-1ed244ac","digest":{"length":167,"function_hash":"231865747446807252932323662572475155023"},"deprecated":false,"signature_type":"Function","target":{"file":"storaged/storaged.cpp","function":"storaged_t::flush_protos"},"source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"},{"signature_version":"v1","id":"ASB-A-170732441-3dbf4449","digest":{"line_hashes":["333093573110175335429488746125791417920","24018071451441426132691213514785838416","86157176319259806533313412164058622231","209717233212138300468968030045070510455"],"threshold":0.9},"deprecated":false,"signature_type":"Line","target":{"file":"storaged/include/storaged.h"},"source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"},{"signature_type":"Line","id":"ASB-A-170732441-8337ed07","digest":{"line_hashes":["148884704183119789745431446125644303789","151394682469363530294625898605493376541","86712825630336742764462619661373391625","232999621503221904690658452854100077325","280944976211515416952632778798809412816","319553659973294052510510398102967269421","279763494788592645457356422232975329263","118097696570985643310754771158743482698","223571053578481352040738937081701268036","230572787833601786447707060666103537776","294362824485928731244488060198716116015","237469369776047100256795032972842369864"],"threshold":0.9},"deprecated":false,"target":{"file":"storaged/storaged.cpp"},"source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","signature_version":"v1"},{"signature_type":"Function","id":"ASB-A-170732441-b158af31","digest":{"length":140,"function_hash":"167519093048703228946247534411643595271"},"deprecated":false,"target":{"file":"storaged/storaged.cpp","function":"storaged_t::add_user_ce"},"source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","signature_version":"v1"},{"signature_version":"v1","id":"ASB-A-170732441-c74cf62a","digest":{"length":170,"function_hash":"300167361355021078898744606461626013266"},"deprecated":false,"signature_type":"Function","target":{"file":"storaged/storaged.cpp","function":"storaged_t::remove_user_ce"},"source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"}],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-170732441.json"}},{"package":{"name":"platform/system/core","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2021-02-01"}]}],"versions":["11"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"],"types":["EoP"],"spl":"2021-02-01","vanir_signatures":[{"signature_version":"v1","id":"ASB-A-170732441-35c8589a","digest":{"line_hashes":["148884704183119789745431446125644303789","151394682469363530294625898605493376541","86712825630336742764462619661373391625","232999621503221904690658452854100077325","280944976211515416952632778798809412816","319553659973294052510510398102967269421","279763494788592645457356422232975329263","118097696570985643310754771158743482698","223571053578481352040738937081701268036","230572787833601786447707060666103537776","294362824485928731244488060198716116015","237469369776047100256795032972842369864"],"threshold":0.9},"deprecated":false,"signature_type":"Line","target":{"file":"storaged/storaged.cpp"},"source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"},{"id":"ASB-A-170732441-468a8c06","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","digest":{"line_hashes":["333093573110175335429488746125791417920","24018071451441426132691213514785838416","86157176319259806533313412164058622231","209717233212138300468968030045070510455"],"threshold":0.9},"deprecated":false,"target":{"file":"storaged/include/storaged.h"},"signature_version":"v1","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","signature_version":"v1","digest":{"length":170,"function_hash":"300167361355021078898744606461626013266"},"deprecated":false,"target":{"file":"storaged/storaged.cpp","function":"storaged_t::remove_user_ce"},"signature_type":"Function","id":"ASB-A-170732441-5ed38433"},{"signature_version":"v1","id":"ASB-A-170732441-90d6f80b","digest":{"length":140,"function_hash":"167519093048703228946247534411643595271"},"deprecated":false,"signature_type":"Function","target":{"file":"storaged/storaged.cpp","function":"storaged_t::add_user_ce"},"source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"},{"id":"ASB-A-170732441-a522127d","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","digest":{"length":167,"function_hash":"231865747446807252932323662572475155023"},"deprecated":false,"target":{"file":"storaged/storaged.cpp","function":"storaged_t::flush_protos"},"signature_version":"v1","signature_type":"Function"}],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-170732441.json"}}],"schema_version":"1.7.5"}