{"id":"ASB-A-176444154","details":"In various functions of DrmPlugin.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-176444154","CVE-2021-0508"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2021-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2021-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/av/+/e07417a9b7829cfb32505947f700fd8dad9e12e6"}],"affected":[{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1:0"},{"fixed":"8.1:2021-06-01"}]}],"versions":["8.1"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"file":"drm/mediadrm/plugins/clearkey/DrmPlugin.cpp","function":"DrmPlugin::queryKeyStatus"},"deprecated":false,"digest":{"length":333,"function_hash":"53845406188586660254644147917993154858"},"id":"ASB-A-176444154-22fb6e61","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/db90c38bdc335869118f9168b167776054d7a290"},{"digest":{"line_hashes":["116293419689235957797644142832982338869","91536267112923248737395670641316584525","84923215158781107856621438053361978491","155740318558482459469259593002638021043"],"threshold":0.9},"id":"ASB-A-176444154-3ac27b42","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/db90c38bdc335869118f9168b167776054d7a290","target":{"file":"drm/mediadrm/plugins/clearkey/DrmPlugin.h"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/db90c38bdc335869118f9168b167776054d7a290","target":{"file":"drm/mediadrm/plugins/clearkey/DrmPlugin.cpp"},"deprecated":false,"digest":{"line_hashes":["168462199271924138225658459456356427237","30795897165636084177713910970499206703","320740076108162832979653989589412533713","339314856917899949697105459553639243218"],"threshold":0.9},"id":"ASB-A-176444154-d853cf9a"}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/db90c38bdc335869118f9168b167776054d7a290"],"severity":"High","spl":"2021-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-176444154.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9:0"},{"fixed":"9:2021-06-01"}]}],"versions":["9"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"file":"drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp"},"deprecated":false,"digest":{"line_hashes":["12825988136066634236985574667124967073","45205286893824864093645941006601319655","263296191186424067700721010834316465565","6416743696019705549291756244586124879","86593308180303407231167108696424521961","282689817409416084412172127054367276921","207213833987636123216926910527826816219","14629586550660593902195539771028495630","10935137506986203545078647555040087146","99300207738115494283750265657524616244","333080766347881722157253125392002926826","166004908089751336578986899325934592326"],"threshold":0.9},"id":"ASB-A-176444154-3baaed5c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e11a4819f04229ac0c7a73585fcbe6a32c4c3524"},{"source":"https://android.googlesource.com/platform/frameworks/av/+/e11a4819f04229ac0c7a73585fcbe6a32c4c3524","target":{"file":"drm/mediadrm/plugins/clearkey/default/include/DrmPlugin.h"},"deprecated":false,"digest":{"line_hashes":["944410713029243776117556749120094087","281147500555576871898109810377836171496","329438668600229624618923935320806429205","251043956328504421949994284052717464266"],"threshold":0.9},"id":"ASB-A-176444154-a6db811f","signature_type":"Line","signature_version":"v1"},{"id":"ASB-A-176444154-c3e5e1dd","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e11a4819f04229ac0c7a73585fcbe6a32c4c3524","target":{"file":"drm/mediadrm/plugins/clearkey/default/DrmPlugin.cpp"},"deprecated":false,"digest":{"line_hashes":["168462199271924138225658459456356427237","30795897165636084177713910970499206703","320740076108162832979653989589412533713","339314856917899949697105459553639243218"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e11a4819f04229ac0c7a73585fcbe6a32c4c3524","target":{"file":"drm/mediadrm/plugins/clearkey/default/DrmPlugin.cpp","function":"DrmPlugin::queryKeyStatus"},"deprecated":false,"digest":{"function_hash":"53845406188586660254644147917993154858","length":333},"id":"ASB-A-176444154-d5de6bd9"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e11a4819f04229ac0c7a73585fcbe6a32c4c3524","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp","function":"DrmPlugin::queryKeyStatus"},"deprecated":false,"digest":{"function_hash":"263621837982489107459561715251884086246","length":480},"id":"ASB-A-176444154-f0a52a41"}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/e11a4819f04229ac0c7a73585fcbe6a32c4c3524"],"severity":"High","spl":"2021-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-176444154.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2021-06-01"}]}],"versions":["10"],"ecosystem_specific":{"severity":"High","spl":"2021-06-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/av/+/3c73391f6e8c4d28f4ed3d1fc7379acdebaa6fa6","target":{"file":"drm/mediadrm/plugins/clearkey/default/DrmPlugin.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["168462199271924138225658459456356427237","30795897165636084177713910970499206703","320740076108162832979653989589412533713","339314856917899949697105459553639243218"]},"id":"ASB-A-176444154-31760a17","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3c73391f6e8c4d28f4ed3d1fc7379acdebaa6fa6","target":{"file":"drm/mediadrm/plugins/clearkey/default/include/DrmPlugin.h"},"deprecated":false,"digest":{"line_hashes":["944410713029243776117556749120094087","281147500555576871898109810377836171496","329438668600229624618923935320806429205","251043956328504421949994284052717464266"],"threshold":0.9},"id":"ASB-A-176444154-88d98588","signature_type":"Line"},{"target":{"file":"drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp","function":"DrmPlugin::queryKeyStatus"},"deprecated":false,"digest":{"function_hash":"263621837982489107459561715251884086246","length":480},"id":"ASB-A-176444154-96cdc29a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3c73391f6e8c4d28f4ed3d1fc7379acdebaa6fa6"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3c73391f6e8c4d28f4ed3d1fc7379acdebaa6fa6","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp"},"deprecated":false,"digest":{"line_hashes":["12825988136066634236985574667124967073","45205286893824864093645941006601319655","263296191186424067700721010834316465565","6416743696019705549291756244586124879","86593308180303407231167108696424521961","282689817409416084412172127054367276921","207213833987636123216926910527826816219","14629586550660593902195539771028495630","10935137506986203545078647555040087146","99300207738115494283750265657524616244","333080766347881722157253125392002926826","166004908089751336578986899325934592326"],"threshold":0.9},"id":"ASB-A-176444154-db4bdd6f","signature_type":"Line"},{"target":{"file":"drm/mediadrm/plugins/clearkey/default/DrmPlugin.cpp","function":"DrmPlugin::queryKeyStatus"},"deprecated":false,"digest":{"length":333,"function_hash":"53845406188586660254644147917993154858"},"id":"ASB-A-176444154-fb13b777","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3c73391f6e8c4d28f4ed3d1fc7379acdebaa6fa6"}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/3c73391f6e8c4d28f4ed3d1fc7379acdebaa6fa6"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-176444154.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2021-06-01"}]}],"versions":["11"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"file":"drm/mediadrm/plugins/clearkey/default/DrmPlugin.cpp"},"deprecated":false,"digest":{"line_hashes":["168462199271924138225658459456356427237","30795897165636084177713910970499206703","320740076108162832979653989589412533713","339314856917899949697105459553639243218"],"threshold":0.9},"id":"ASB-A-176444154-1e59ed40","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e07417a9b7829cfb32505947f700fd8dad9e12e6"},{"id":"ASB-A-176444154-2b32e8bc","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e07417a9b7829cfb32505947f700fd8dad9e12e6","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp"},"deprecated":false,"digest":{"line_hashes":["12825988136066634236985574667124967073","45205286893824864093645941006601319655","263296191186424067700721010834316465565","6416743696019705549291756244586124879","86593308180303407231167108696424521961","282689817409416084412172127054367276921","207213833987636123216926910527826816219","14629586550660593902195539771028495630","10935137506986203545078647555040087146","99300207738115494283750265657524616244","333080766347881722157253125392002926826","166004908089751336578986899325934592326"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/frameworks/av/+/e07417a9b7829cfb32505947f700fd8dad9e12e6","target":{"file":"drm/mediadrm/plugins/clearkey/hidl/DrmPlugin.cpp","function":"DrmPlugin::queryKeyStatus"},"deprecated":false,"digest":{"length":480,"function_hash":"263621837982489107459561715251884086246"},"id":"ASB-A-176444154-c7c3b502","signature_type":"Function","signature_version":"v1"},{"target":{"file":"drm/mediadrm/plugins/clearkey/default/DrmPlugin.cpp","function":"DrmPlugin::queryKeyStatus"},"deprecated":false,"digest":{"function_hash":"53845406188586660254644147917993154858","length":333},"id":"ASB-A-176444154-ecd79a0d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e07417a9b7829cfb32505947f700fd8dad9e12e6"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/e07417a9b7829cfb32505947f700fd8dad9e12e6","target":{"file":"drm/mediadrm/plugins/clearkey/default/include/DrmPlugin.h"},"deprecated":false,"digest":{"line_hashes":["944410713029243776117556749120094087","281147500555576871898109810377836171496","329438668600229624618923935320806429205","251043956328504421949994284052717464266"],"threshold":0.9},"id":"ASB-A-176444154-f3942319"}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/e07417a9b7829cfb32505947f700fd8dad9e12e6"],"severity":"High","spl":"2021-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-176444154.json"}}],"schema_version":"1.9.0"}