{"id":"ASB-A-174768985","details":"In updateInfo of android_hardware_input_InputApplicationHandle.cpp, there is a possible control of code flow due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-174768985","CVE-2021-0442"],"modified":"2026-07-10T15:26:01.587957612Z","published":"2021-04-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2021-04-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/a5eb01054b44472d32bda00066dc6ffceb9123d1"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2021-04-01"}]}],"versions":["11"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9","digest":{"line_hashes":["153744076643136944585803601936704252406","191069972467045260179571494410002778197","202681386905527720655919683999869261721","15958127332518746767328068968191205640","318299242881945210416292452118564584693","55375548146193762839776290877106867454","202310136962832530345017029727712797741"],"threshold":0.9},"signature_type":"Line","signature_version":"v1","id":"ASB-A-174768985-04caa71e","target":{"file":"services/core/java/com/android/server/wm/DragState.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["271546497008423922007134332397750106801","135376793536561302429612198419805683377","257683765209509567829787144032624769991","162579258192833944394269057382934617028","83439147027032957021504045159767500334","37354576528130784416446125731969042512","189483160974541279312152320671132463449","109451405292327600871396085012624285017","151273012959209593096603173428095289063","90930562893205979910989518243025177110"],"threshold":0.9},"signature_type":"Line","signature_version":"v1","id":"ASB-A-174768985-15566071","target":{"file":"core/java/android/view/InputApplicationHandle.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9"},{"deprecated":false,"digest":{"line_hashes":["26957685519766614503589251201715250823","321531819659876158111800959134030260503","102292509821670253063205959530953119682","127881413443537950781394393579443572909","252141743465987673416136319460067673442","29635728004460658695423747706617846811","320905234923437747534973550871417416541","108960937413202098903920995227531576931","179811016529985193274331088371148061034","145547028764017056133629275910941138982","202589890298668617314104527572573528803"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9","signature_version":"v1","id":"ASB-A-174768985-20b16991","target":{"file":"services/core/java/com/android/server/wm/ActivityRecord.java"},"signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["171337628856895462170428563135667480767","175849593308080929364969470679777901591","107640031197165006063430346673722033218","161193235010992212944116184996842124384"],"threshold":0.9},"signature_type":"Line","signature_version":"v1","id":"ASB-A-174768985-29b295ec","target":{"file":"core/java/android/view/InputWindowHandle.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9"},{"deprecated":false,"digest":{"line_hashes":["83368269012663771016049970579209844722","286708047613863889839923145739538902379","223586558792224597393547820259128359624","246955963403290088873544787201627998369","331394319946452497981790835407920437345","44618377489504844624472829319631502855","174358142572029452316023607642450521601","15540230614059821618049035737051309569","296341302774128398263045739389654295151","250022653165885384938581463379527764361","8129687793026399158356652003959754672","134175639946818297988967965025965143791","308553176132704873761358313074362008004","330502945947621550835230208288804183704","114603130514586176985481021889933629272","149308747222860460561536587935144377939","310189140216267090555336510730476793184","163853490069869190901724122294504165010","317049367158872872197623055599075618926"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9","signature_version":"v1","id":"ASB-A-174768985-2b2e1131","target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java"},"signature_type":"Line"},{"deprecated":false,"digest":{"length":5286,"function_hash":"132134078652155884660179338492736332241"},"signature_type":"Function","signature_version":"v1","id":"ASB-A-174768985-3f15a943","target":{"file":"services/core/java/com/android/server/wm/ActivityRecord.java","function":"ActivityRecord"},"source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9"},{"signature_type":"Function","digest":{"length":1602,"function_hash":"247053537370944156507000072792808381565"},"deprecated":false,"signature_version":"v1","id":"ASB-A-174768985-42d7f274","target":{"file":"services/core/java/com/android/server/wm/InputConsumerImpl.java","function":"InputConsumerImpl"},"source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9","digest":{"length":683,"function_hash":"78330140433301931354312180114754379654"},"signature_type":"Function","signature_version":"v1","id":"ASB-A-174768985-4a31c1cf","target":{"file":"core/jni/android_hardware_input_InputApplicationHandle.cpp","function":"NativeInputApplicationHandle::updateInfo"},"deprecated":false},{"deprecated":false,"digest":{"length":51,"function_hash":"216190859915552726671707505792069809036"},"source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9","signature_version":"v1","id":"ASB-A-174768985-4b3cfaf4","target":{"file":"core/java/android/view/InputApplicationHandle.java","function":"InputApplicationHandle"},"signature_type":"Function"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9","digest":{"length":2649,"function_hash":"108642266354670242015681993626743599789"},"signature_type":"Function","signature_version":"v1","id":"ASB-A-174768985-533b0dcb","target":{"file":"services/core/java/com/android/server/wm/TaskPositioner.java","function":"register"},"deprecated":false},{"signature_type":"Function","digest":{"length":347,"function_hash":"142534661548562157915207785493089768884"},"deprecated":false,"signature_version":"v1","id":"ASB-A-174768985-6697982b","target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java","function":"setFocusedAppLw"},"source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9","digest":{"length":1687,"function_hash":"15518855643381758960988747378871682625"},"signature_type":"Function","signature_version":"v1","id":"ASB-A-174768985-6ea15bcd","target":{"file":"services/core/java/com/android/server/wm/DragState.java","function":"InputInterceptor"},"deprecated":false},{"signature_type":"Line","digest":{"line_hashes":["201137968757774036011500386299193558621","48373362057840241665531178653613190383","5191521543138551507807575226648266125","203311827832482211997432379385433077069","127930764700712658146149619023655277721","101947489553470850814291482442190922960","337972922942139157860659371462974656346"],"threshold":0.9},"deprecated":false,"signature_version":"v1","id":"ASB-A-174768985-6fbe5bd2","target":{"file":"services/core/java/com/android/server/wm/TaskPositioner.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9"},{"signature_type":"Function","digest":{"length":1397,"function_hash":"77486036293143334442594680999603560102"},"deprecated":false,"signature_version":"v1","id":"ASB-A-174768985-a443f5da","target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java","function":"populateInputWindowHandle"},"source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9"},{"deprecated":false,"digest":{"line_hashes":["271420804206205498737942444950354212790","26972480082679670746746807526704798503","292776199800831195640098750981070917387","198653486015484748682929179998445879170"],"threshold":0.9},"signature_type":"Line","signature_version":"v1","id":"ASB-A-174768985-b3711bed","target":{"file":"services/core/java/com/android/server/wm/WindowState.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9"},{"deprecated":false,"digest":{"length":2911,"function_hash":"218135769503400627448119552659594310412"},"signature_type":"Function","signature_version":"v1","id":"ASB-A-174768985-e983cc70","target":{"file":"services/core/java/com/android/server/wm/WindowState.java","function":"WindowState"},"source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9"},{"signature_type":"Line","digest":{"line_hashes":["145570212539964443255974915325890039347","251852284830843490762201293182960991294","299754344963634365290334342999266153945","277509967450370874576482820226584818579"],"threshold":0.9},"deprecated":false,"signature_version":"v1","id":"ASB-A-174768985-f03a04c1","target":{"file":"core/jni/android_hardware_input_InputApplicationHandle.cpp"},"source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9"},{"signature_type":"Line","digest":{"line_hashes":["175933733805455145097584040246438524843","105461127785727044380913160268439453305","305034128722697340549031228211472881336","93208044332548877171188181052558065619","215388775232037441973613713031297832777","209699070831022211689508349717542155377","237722352014975723671798766190927613549"],"threshold":0.9},"deprecated":false,"signature_version":"v1","id":"ASB-A-174768985-fe62b77c","target":{"file":"services/core/java/com/android/server/wm/InputConsumerImpl.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9"}],"severity":"High","spl":"2021-04-01","types":["EoP"],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a68473ce978f3e3ad73bd127cdcfcf663d9fd4d9"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-174768985.json"}}],"schema_version":"1.7.5"}