{"id":"ASB-A-176237595","details":"In several functions of MemoryFileSystem.cpp and related files, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-176237595","CVE-2021-0520"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2021-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2021-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/av/+/3b1141d44f448ea9a528ff8af8f128686c35039d"}],"affected":[{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2021-06-01"}]}],"versions":["10"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"line_hashes":["307566612184893186510305798813647127224","285298985623636682568305391053296096877","111376868104747373946296790355126321067","218155673646380593431406910228724813348","169163152333455150952813660206241474972","214416941494875041276942103755170253978","22979584127819604067779458927804977041"],"threshold":0.9},"id":"ASB-A-176237595-2284b73a","match_only_versions":["10"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/9ba33b35860503814ed02bf5bcf5ff24e4056f6d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/include/MemoryFileSystem.h"},"deprecated":false},{"id":"ASB-A-176237595-36da587a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/9ba33b35860503814ed02bf5bcf5ff24e4056f6d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/include/DrmPlugin.h"},"deprecated":false,"digest":{"line_hashes":["98016313766012792984877754816329625159","207975132946194396972298201588891122375","132397567202481039594741100467746445713","14036518118138290610104113776833174842"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"280414717969698508767893960612810316362","length":304},"id":"ASB-A-176237595-3a22ef36","match_only_versions":["10"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/9ba33b35860503814ed02bf5bcf5ff24e4056f6d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/MemoryFileSystem.cpp","function":"MemoryFileSystem::RemoveFile"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/9ba33b35860503814ed02bf5bcf5ff24e4056f6d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp","function":"DrmPlugin::removeOfflineLicense"},"deprecated":false,"digest":{"function_hash":"56377441534790650884365848959255683274","length":293},"id":"ASB-A-176237595-49c5f155","match_only_versions":["10"]},{"digest":{"function_hash":"290170483095585134446400290876693945376","length":380},"id":"ASB-A-176237595-4c941966","match_only_versions":["10"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/9ba33b35860503814ed02bf5bcf5ff24e4056f6d","target":{"function":"MemoryFileSystem::Read","file":"drm/mediadrm/plugins/clearkey/hidl/MemoryFileSystem.cpp"},"deprecated":false},{"deprecated":false,"digest":{"length":699,"function_hash":"259186125320602506857942297194105161950"},"id":"ASB-A-176237595-5731f3e4","match_only_versions":["10"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/9ba33b35860503814ed02bf5bcf5ff24e4056f6d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp","function":"DrmPlugin::makeKeySetId"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/9ba33b35860503814ed02bf5bcf5ff24e4056f6d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp"},"deprecated":false,"digest":{"line_hashes":["167465959188102214322272343717963764420","91584336904149886579656651327175374708","111882419373869863115197327925109713295","248554840161429144642399717796597924346","130257098166118111868450049785264725529","200728120008924478975019041916647228029","197762471420842100313592897005482908960","230955576510512387849990911300949649243","246202988748263719246793088594557981184","188306764338768351529267083783696580151","128647143365315867171041227725098227357","103491703471494470090646333865959584902","34199310167999064311337238664197961261","333786853609218891768890328428370663824","101249072103650608403192788092491573414","154763545970702227246749488656853431283","198891738745409233078538996972589098132","127280881261712206774592481470803407712","186642185276642447379237466515748883511","25808546729381193470950803477781075864","251456678047814088429341038922289497910","32928382785518256223984650300891616054","4927573504111776904915316152951837767","74453851442280720895303201575646880107","257809563614014242675045255171750097453","231055277446217611567926498609551633231","71787708119133698920989109757160784465","51859937721698357060834271275165908449","298498318454108610644965677884402538419","103646664411705008328423378213441857759","199718428122209125429859400629808047468"],"threshold":0.9},"id":"ASB-A-176237595-5bd9cbd7","match_only_versions":["10"]},{"source":"https://android.googlesource.com/platform/frameworks/av/+/9ba33b35860503814ed02bf5bcf5ff24e4056f6d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/MemoryFileSystem.cpp"},"deprecated":false,"digest":{"line_hashes":["172055581127389310259934318737046658125","237934238854497305784749969755755666332","108702744614423496725138917566598870107","120909401969203372801902388078382209366","215706619906718557676336491136595107920","28114112168387778999516361594979865550","300670624045693819691773835443945850780","296219072534950563784970069115622800808","225492542353939975283411755767080912260","126973419718923725152884021559843478673","98657534283665685325632298025510903744","301546277590160819383323967239547086488","67513860305216349735575240149948264000","155463808617527160055289338288777893678","83045826910925264387955343333630756249","185754663068956153323480480116516796035","76240649137872141943478552388908529661","195155558315510671368344975816843661750","262145407576888433690543640702495865740","80513796829160959222100576279623566038","110228077831682683802145820264071089636","79863566905860225096629040609344408127","329440250993985645288885042066130145809","215583046705652153191522537616831777585","310169722159967636069871653581932546952","282404697480065614289763315374938389013","148795970676421281788586270900887306014","215933811881003252697697833481313315053"],"threshold":0.9},"id":"ASB-A-176237595-67746931","match_only_versions":["10"],"signature_type":"Line","signature_version":"v1"},{"id":"ASB-A-176237595-6867d8bb","match_only_versions":["10"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/9ba33b35860503814ed02bf5bcf5ff24e4056f6d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/MemoryFileSystem.cpp","function":"MemoryFileSystem::ListFiles"},"deprecated":false,"digest":{"function_hash":"279455669684810869968631840568798576538","length":190}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/9ba33b35860503814ed02bf5bcf5ff24e4056f6d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/MemoryFileSystem.cpp","function":"MemoryFileSystem::Write"},"deprecated":false,"digest":{"function_hash":"313620152516000522070536905650735857976","length":360},"id":"ASB-A-176237595-6a2d49b8","match_only_versions":["10"]},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/9ba33b35860503814ed02bf5bcf5ff24e4056f6d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/MemoryFileSystem.cpp","function":"MemoryFileSystem::RemoveAllFiles"},"deprecated":false,"digest":{"function_hash":"132402728794421139756730851525794072824","length":119},"id":"ASB-A-176237595-7999a9c1","match_only_versions":["10"],"signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/9ba33b35860503814ed02bf5bcf5ff24e4056f6d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp","function":"DrmPlugin::getOfflineLicenseKeySetIds"},"deprecated":false,"digest":{"length":447,"function_hash":"130934893610876758725476876475271221009"},"id":"ASB-A-176237595-7a7d14a6","match_only_versions":["10"]},{"id":"ASB-A-176237595-92c0bc0e","match_only_versions":["10"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/9ba33b35860503814ed02bf5bcf5ff24e4056f6d","target":{"function":"DrmPlugin::restoreKeys","file":"drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp"},"deprecated":false,"digest":{"function_hash":"223629748653852921757471305225719004757","length":929}},{"source":"https://android.googlesource.com/platform/frameworks/av/+/9ba33b35860503814ed02bf5bcf5ff24e4056f6d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/MemoryFileSystem.cpp","function":"MemoryFileSystem::GetFileSize"},"deprecated":false,"digest":{"function_hash":"150221699405232435931457032128476032032","length":318},"id":"ASB-A-176237595-b435f4e6","match_only_versions":["10"],"signature_type":"Function","signature_version":"v1"},{"match_only_versions":["10"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/9ba33b35860503814ed02bf5bcf5ff24e4056f6d","target":{"function":"MemoryFileSystem::FileExists","file":"drm/mediadrm/plugins/clearkey/hidl/MemoryFileSystem.cpp"},"deprecated":false,"digest":{"function_hash":"290242603042890076920768315108514407060","length":163},"id":"ASB-A-176237595-c3f98c9a"},{"target":{"file":"drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp","function":"DrmPlugin::getOfflineLicenseState"},"deprecated":false,"digest":{"function_hash":"42007760991788800081274188316115233021","length":712},"id":"ASB-A-176237595-d78d3a9d","match_only_versions":["10"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/9ba33b35860503814ed02bf5bcf5ff24e4056f6d"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/9ba33b35860503814ed02bf5bcf5ff24e4056f6d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp","function":"DrmPlugin::getKeyRequestCommon"},"deprecated":false,"digest":{"function_hash":"155457508089819586038033155395758281951","length":1821},"id":"ASB-A-176237595-eaa1f187"},{"id":"ASB-A-176237595-ffce63fe","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/9ba33b35860503814ed02bf5bcf5ff24e4056f6d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp","function":"DrmPlugin::provideKeyResponse"},"deprecated":false,"digest":{"function_hash":"232176693834341067388549305246891873670","length":2330}}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/9ba33b35860503814ed02bf5bcf5ff24e4056f6d"],"severity":"High","spl":"2021-06-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-176237595.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2021-06-01"}]}],"versions":["11"],"ecosystem_specific":{"severity":"High","spl":"2021-06-01","types":["EoP"],"vanir_signatures":[{"digest":{"length":2566,"function_hash":"171188128310989098483596192589988727746"},"id":"ASB-A-176237595-0cfdccad","match_only_versions":["11"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3b1141d44f448ea9a528ff8af8f128686c35039d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp","function":"DrmPlugin::provideKeyResponse"},"deprecated":false},{"id":"ASB-A-176237595-15f67416","match_only_versions":["11"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3b1141d44f448ea9a528ff8af8f128686c35039d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/MemoryFileSystem.cpp","function":"MemoryFileSystem::RemoveAllFiles"},"deprecated":false,"digest":{"function_hash":"132402728794421139756730851525794072824","length":119}},{"match_only_versions":["11"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3b1141d44f448ea9a528ff8af8f128686c35039d","target":{"function":"MemoryFileSystem::Write","file":"drm/mediadrm/plugins/clearkey/hidl/MemoryFileSystem.cpp"},"deprecated":false,"digest":{"function_hash":"313620152516000522070536905650735857976","length":360},"id":"ASB-A-176237595-1d0ac4ea"},{"digest":{"line_hashes":["167465959188102214322272343717963764420","91584336904149886579656651327175374708","111882419373869863115197327925109713295","248554840161429144642399717796597924346","130257098166118111868450049785264725529","200728120008924478975019041916647228029","197762471420842100313592897005482908960","230955576510512387849990911300949649243","246202988748263719246793088594557981184","188306764338768351529267083783696580151","116950445027025853348666456636947746246","70531637217183646788154326965574807032","34199310167999064311337238664197961261","333786853609218891768890328428370663824","101249072103650608403192788092491573414","154763545970702227246749488656853431283","198891738745409233078538996972589098132","127280881261712206774592481470803407712","186642185276642447379237466515748883511","25808546729381193470950803477781075864","251456678047814088429341038922289497910","32928382785518256223984650300891616054","4927573504111776904915316152951837767","74453851442280720895303201575646880107","257809563614014242675045255171750097453","231055277446217611567926498609551633231","71787708119133698920989109757160784465","51859937721698357060834271275165908449","298498318454108610644965677884402538419","103646664411705008328423378213441857759","199718428122209125429859400629808047468"],"threshold":0.9},"id":"ASB-A-176237595-2a397919","match_only_versions":["11"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3b1141d44f448ea9a528ff8af8f128686c35039d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp"},"deprecated":false},{"digest":{"length":163,"function_hash":"290242603042890076920768315108514407060"},"id":"ASB-A-176237595-382732a0","match_only_versions":["11"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3b1141d44f448ea9a528ff8af8f128686c35039d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/MemoryFileSystem.cpp","function":"MemoryFileSystem::FileExists"},"deprecated":false},{"match_only_versions":["11"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3b1141d44f448ea9a528ff8af8f128686c35039d","target":{"function":"MemoryFileSystem::RemoveFile","file":"drm/mediadrm/plugins/clearkey/hidl/MemoryFileSystem.cpp"},"deprecated":false,"digest":{"function_hash":"280414717969698508767893960612810316362","length":304},"id":"ASB-A-176237595-394053d4"},{"deprecated":false,"digest":{"function_hash":"56377441534790650884365848959255683274","length":293},"id":"ASB-A-176237595-531e5d76","match_only_versions":["11"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3b1141d44f448ea9a528ff8af8f128686c35039d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp","function":"DrmPlugin::removeOfflineLicense"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3b1141d44f448ea9a528ff8af8f128686c35039d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp","function":"DrmPlugin::restoreKeys"},"deprecated":false,"digest":{"function_hash":"223629748653852921757471305225719004757","length":929},"id":"ASB-A-176237595-5d5b8640","match_only_versions":["11"],"signature_type":"Function"},{"digest":{"function_hash":"279455669684810869968631840568798576538","length":190},"id":"ASB-A-176237595-5df29985","match_only_versions":["11"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3b1141d44f448ea9a528ff8af8f128686c35039d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/MemoryFileSystem.cpp","function":"MemoryFileSystem::ListFiles"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["98016313766012792984877754816329625159","93009046433394417834197826338471062670","299832356352725215931248843431150227810","187419567163982050424601048561626171280"],"threshold":0.9},"id":"ASB-A-176237595-6dacc013","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3b1141d44f448ea9a528ff8af8f128686c35039d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/include/DrmPlugin.h"}},{"source":"https://android.googlesource.com/platform/frameworks/av/+/3b1141d44f448ea9a528ff8af8f128686c35039d","target":{"function":"DrmPlugin::getOfflineLicenseKeySetIds","file":"drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp"},"deprecated":false,"digest":{"function_hash":"130934893610876758725476876475271221009","length":447},"id":"ASB-A-176237595-7b295d23","match_only_versions":["11"],"signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3b1141d44f448ea9a528ff8af8f128686c35039d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/include/MemoryFileSystem.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["307566612184893186510305798813647127224","285298985623636682568305391053296096877","111376868104747373946296790355126321067","218155673646380593431406910228724813348","169163152333455150952813660206241474972","214416941494875041276942103755170253978","22979584127819604067779458927804977041"]},"id":"ASB-A-176237595-7c0dbbcb","match_only_versions":["11"],"signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3b1141d44f448ea9a528ff8af8f128686c35039d","target":{"function":"MemoryFileSystem::GetFileSize","file":"drm/mediadrm/plugins/clearkey/hidl/MemoryFileSystem.cpp"},"deprecated":false,"digest":{"length":318,"function_hash":"150221699405232435931457032128476032032"},"id":"ASB-A-176237595-8dfeae7f","match_only_versions":["11"],"signature_type":"Function"},{"id":"ASB-A-176237595-9f2ad667","match_only_versions":["11"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3b1141d44f448ea9a528ff8af8f128686c35039d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp","function":"DrmPlugin::getOfflineLicenseState"},"deprecated":false,"digest":{"function_hash":"42007760991788800081274188316115233021","length":712}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3b1141d44f448ea9a528ff8af8f128686c35039d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp","function":"DrmPlugin::getKeyRequestCommon"},"deprecated":false,"digest":{"length":1821,"function_hash":"155457508089819586038033155395758281951"},"id":"ASB-A-176237595-a02e4642"},{"deprecated":false,"digest":{"length":699,"function_hash":"259186125320602506857942297194105161950"},"id":"ASB-A-176237595-bdc31474","match_only_versions":["11"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3b1141d44f448ea9a528ff8af8f128686c35039d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp","function":"DrmPlugin::makeKeySetId"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3b1141d44f448ea9a528ff8af8f128686c35039d","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/MemoryFileSystem.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["172055581127389310259934318737046658125","237934238854497305784749969755755666332","108702744614423496725138917566598870107","120909401969203372801902388078382209366","215706619906718557676336491136595107920","28114112168387778999516361594979865550","300670624045693819691773835443945850780","296219072534950563784970069115622800808","225492542353939975283411755767080912260","126973419718923725152884021559843478673","98657534283665685325632298025510903744","301546277590160819383323967239547086488","67513860305216349735575240149948264000","155463808617527160055289338288777893678","83045826910925264387955343333630756249","185754663068956153323480480116516796035","76240649137872141943478552388908529661","195155558315510671368344975816843661750","262145407576888433690543640702495865740","80513796829160959222100576279623566038","110228077831682683802145820264071089636","79863566905860225096629040609344408127","329440250993985645288885042066130145809","215583046705652153191522537616831777585","310169722159967636069871653581932546952","282404697480065614289763315374938389013","148795970676421281788586270900887306014","215933811881003252697697833481313315053"]},"id":"ASB-A-176237595-e0ca1351","match_only_versions":["11"],"signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3b1141d44f448ea9a528ff8af8f128686c35039d","target":{"function":"MemoryFileSystem::Read","file":"drm/mediadrm/plugins/clearkey/hidl/MemoryFileSystem.cpp"},"deprecated":false,"digest":{"length":380,"function_hash":"290170483095585134446400290876693945376"},"id":"ASB-A-176237595-f75a4f1b","match_only_versions":["11"],"signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/3b1141d44f448ea9a528ff8af8f128686c35039d"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-176237595.json"}}],"schema_version":"1.9.0"}