{"id":"ASB-A-170732441","details":"In add_user_ce and remove_user_ce of storaged.cpp, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in storaged with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-170732441","CVE-2021-0330"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2021-02-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2021-02-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"}],"affected":[{"package":{"name":"platform/system/core","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0:0"},{"fixed":"8.0:2021-02-01"}]}],"versions":["8.0"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"length":170,"function_hash":"300167361355021078898744606461626013266"},"id":"ASB-A-170732441-3e541011","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","target":{"file":"storaged/storaged.cpp","function":"storaged_t::remove_user_ce"}},{"id":"ASB-A-170732441-44e4e2c0","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","target":{"file":"storaged/storaged.cpp"},"deprecated":false,"digest":{"line_hashes":["148884704183119789745431446125644303789","151394682469363530294625898605493376541","86712825630336742764462619661373391625","232999621503221904690658452854100077325","280944976211515416952632778798809412816","319553659973294052510510398102967269421","279763494788592645457356422232975329263","118097696570985643310754771158743482698","223571053578481352040738937081701268036","230572787833601786447707060666103537776","294362824485928731244488060198716116015","237469369776047100256795032972842369864"],"threshold":0.9}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","target":{"function":"storaged_t::add_user_ce","file":"storaged/storaged.cpp"},"deprecated":false,"digest":{"length":140,"function_hash":"167519093048703228946247534411643595271"},"id":"ASB-A-170732441-66204d59","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","target":{"file":"storaged/include/storaged.h"},"deprecated":false,"digest":{"line_hashes":["333093573110175335429488746125791417920","24018071451441426132691213514785838416","86157176319259806533313412164058622231","209717233212138300468968030045070510455"],"threshold":0.9},"id":"ASB-A-170732441-dd16adc0","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","target":{"file":"storaged/storaged.cpp","function":"storaged_t::flush_protos"},"deprecated":false,"digest":{"length":167,"function_hash":"231865747446807252932323662572475155023"},"id":"ASB-A-170732441-e1a66dcc"}],"fixes":["https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"],"severity":"High","spl":"2021-02-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-170732441.json"}},{"package":{"name":"platform/system/core","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1:0"},{"fixed":"8.1:2021-02-01"}]}],"versions":["8.1"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"file":"storaged/storaged.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["148884704183119789745431446125644303789","151394682469363530294625898605493376541","86712825630336742764462619661373391625","232999621503221904690658452854100077325","280944976211515416952632778798809412816","319553659973294052510510398102967269421","279763494788592645457356422232975329263","118097696570985643310754771158743482698","223571053578481352040738937081701268036","230572787833601786447707060666103537776","294362824485928731244488060198716116015","237469369776047100256795032972842369864"]},"id":"ASB-A-170732441-0796c768","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"},{"target":{"file":"storaged/storaged.cpp","function":"storaged_t::remove_user_ce"},"deprecated":false,"digest":{"function_hash":"300167361355021078898744606461626013266","length":170},"id":"ASB-A-170732441-7be477fa","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"},{"source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","target":{"function":"storaged_t::add_user_ce","file":"storaged/storaged.cpp"},"deprecated":false,"digest":{"function_hash":"167519093048703228946247534411643595271","length":140},"id":"ASB-A-170732441-9850fc47","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["333093573110175335429488746125791417920","24018071451441426132691213514785838416","86157176319259806533313412164058622231","209717233212138300468968030045070510455"],"threshold":0.9},"id":"ASB-A-170732441-c1598fd3","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","target":{"file":"storaged/include/storaged.h"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","target":{"file":"storaged/storaged.cpp","function":"storaged_t::flush_protos"},"deprecated":false,"digest":{"function_hash":"231865747446807252932323662572475155023","length":167},"id":"ASB-A-170732441-cfa6677c","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"],"severity":"High","spl":"2021-02-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-170732441.json"}},{"package":{"name":"platform/system/core","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9:0"},{"fixed":"9:2021-02-01"}]}],"versions":["9"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"],"severity":"High","spl":"2021-02-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","target":{"file":"storaged/storaged.cpp","function":"storaged_t::flush_protos"},"deprecated":false,"digest":{"function_hash":"231865747446807252932323662572475155023","length":167},"id":"ASB-A-170732441-1158d785","signature_type":"Function"},{"target":{"file":"storaged/storaged.cpp","function":"storaged_t::remove_user_ce"},"deprecated":false,"digest":{"length":170,"function_hash":"300167361355021078898744606461626013266"},"id":"ASB-A-170732441-6c4bcf07","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","target":{"file":"storaged/include/storaged.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["333093573110175335429488746125791417920","24018071451441426132691213514785838416","86157176319259806533313412164058622231","209717233212138300468968030045070510455"]},"id":"ASB-A-170732441-ca352177","signature_type":"Line"},{"id":"ASB-A-170732441-e54179dd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","target":{"function":"storaged_t::add_user_ce","file":"storaged/storaged.cpp"},"deprecated":false,"digest":{"function_hash":"167519093048703228946247534411643595271","length":140}},{"digest":{"line_hashes":["148884704183119789745431446125644303789","151394682469363530294625898605493376541","86712825630336742764462619661373391625","232999621503221904690658452854100077325","280944976211515416952632778798809412816","319553659973294052510510398102967269421","279763494788592645457356422232975329263","118097696570985643310754771158743482698","223571053578481352040738937081701268036","230572787833601786447707060666103537776","294362824485928731244488060198716116015","237469369776047100256795032972842369864"],"threshold":0.9},"id":"ASB-A-170732441-f2c7691c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","target":{"file":"storaged/storaged.cpp"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-170732441.json"}},{"package":{"name":"platform/system/core","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2021-02-01"}]}],"versions":["10"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"],"severity":"High","spl":"2021-02-01","types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"231865747446807252932323662572475155023","length":167},"id":"ASB-A-170732441-1ed244ac","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","target":{"file":"storaged/storaged.cpp","function":"storaged_t::flush_protos"},"deprecated":false},{"digest":{"line_hashes":["333093573110175335429488746125791417920","24018071451441426132691213514785838416","86157176319259806533313412164058622231","209717233212138300468968030045070510455"],"threshold":0.9},"id":"ASB-A-170732441-3dbf4449","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","target":{"file":"storaged/include/storaged.h"},"deprecated":false},{"id":"ASB-A-170732441-8337ed07","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","target":{"file":"storaged/storaged.cpp"},"deprecated":false,"digest":{"line_hashes":["148884704183119789745431446125644303789","151394682469363530294625898605493376541","86712825630336742764462619661373391625","232999621503221904690658452854100077325","280944976211515416952632778798809412816","319553659973294052510510398102967269421","279763494788592645457356422232975329263","118097696570985643310754771158743482698","223571053578481352040738937081701268036","230572787833601786447707060666103537776","294362824485928731244488060198716116015","237469369776047100256795032972842369864"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","target":{"file":"storaged/storaged.cpp","function":"storaged_t::add_user_ce"},"deprecated":false,"digest":{"function_hash":"167519093048703228946247534411643595271","length":140},"id":"ASB-A-170732441-b158af31","signature_type":"Function","signature_version":"v1"},{"target":{"function":"storaged_t::remove_user_ce","file":"storaged/storaged.cpp"},"deprecated":false,"digest":{"function_hash":"300167361355021078898744606461626013266","length":170},"id":"ASB-A-170732441-c74cf62a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-170732441.json"}},{"package":{"name":"platform/system/core","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2021-02-01"}]}],"versions":["11"],"ecosystem_specific":{"severity":"High","spl":"2021-02-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","target":{"file":"storaged/storaged.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["148884704183119789745431446125644303789","151394682469363530294625898605493376541","86712825630336742764462619661373391625","232999621503221904690658452854100077325","280944976211515416952632778798809412816","319553659973294052510510398102967269421","279763494788592645457356422232975329263","118097696570985643310754771158743482698","223571053578481352040738937081701268036","230572787833601786447707060666103537776","294362824485928731244488060198716116015","237469369776047100256795032972842369864"]},"id":"ASB-A-170732441-35c8589a","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","target":{"file":"storaged/include/storaged.h"},"deprecated":false,"digest":{"line_hashes":["333093573110175335429488746125791417920","24018071451441426132691213514785838416","86157176319259806533313412164058622231","209717233212138300468968030045070510455"],"threshold":0.9},"id":"ASB-A-170732441-468a8c06","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","target":{"file":"storaged/storaged.cpp","function":"storaged_t::remove_user_ce"},"deprecated":false,"digest":{"function_hash":"300167361355021078898744606461626013266","length":170},"id":"ASB-A-170732441-5ed38433","signature_type":"Function"},{"target":{"file":"storaged/storaged.cpp","function":"storaged_t::add_user_ce"},"deprecated":false,"digest":{"function_hash":"167519093048703228946247534411643595271","length":140},"id":"ASB-A-170732441-90d6f80b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe","target":{"function":"storaged_t::flush_protos","file":"storaged/storaged.cpp"},"deprecated":false,"digest":{"function_hash":"231865747446807252932323662572475155023","length":167},"id":"ASB-A-170732441-a522127d","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/system/core/+/79fc288f10814d5862a2320d0e0732040a4823fe"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-170732441.json"}}],"schema_version":"1.9.0"}