{"id":"ASB-A-176444161","details":"In various functions of CryptoPlugin.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-176444161","CVE-2021-0509"],"modified":"2026-05-25T16:46:24.913870386Z","published":"2021-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2021-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/av/+/79a6ffbdaf14cfbb597efd8545ba401f1da28a4f"},{"type":"FIX","url":"https://android.googlesource.com/platform/hardware/interfaces/+/a4e76aab230a565dd0cef11e2e6e2d782b685327"}],"affected":[{"package":{"name":"platform/hardware/interfaces","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1:0"},{"fixed":"8.1:2021-06-01"}]}],"versions":["8.1"],"ecosystem_specific":{"spl":"2021-06-01","fixes":["https://android.googlesource.com/platform/hardware/interfaces/+/7e4c587ae32aca644254fa206de5131553975f4b"],"severity":"High","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/interfaces/+/7e4c587ae32aca644254fa206de5131553975f4b","deprecated":false,"target":{"function":"CryptoPlugin::setSharedBufferBase","file":"drm/1.0/default/CryptoPlugin.cpp"},"id":"ASB-A-176444161-3a4f3261","digest":{"function_hash":"83804324151596417791924039404182904851","length":233}},{"target":{"file":"drm/1.0/default/CryptoPlugin.h"},"signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/interfaces/+/7e4c587ae32aca644254fa206de5131553975f4b","signature_type":"Line","id":"ASB-A-176444161-d38c61f9","digest":{"threshold":0.9,"line_hashes":["338734003058650768117569873538913139211","48334840324752538220133656459956211134","74219866353171461841539864830050274457","222290197317652465409581001700111359761","87089908589932915432556193581794380754","54706185110868442096262177696595696279","324607132481506265150981429704786906864","136556778993816125910016875516885690619","68342775054458916267650814659772342317","303034744072508462164836128000890610502","298561505625679081913440228746743709653","244686149178940169759062632632814000223","326167035501015315238203021377548683500","199164574376375895138658068341247569159","173622098562518735989600364692111324601","8820646153323049783395416090839125310","61786442267307842068128269464010653229","184832951823819122292927511161264090234","18208972824218449988403253158397327668"]},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/interfaces/+/7e4c587ae32aca644254fa206de5131553975f4b","id":"ASB-A-176444161-e14e8d49","digest":{"threshold":0.9,"line_hashes":["221586211301701561923541131000659257682","214302883976724642944160823531773350831","228857402668709192371015871719057283554","178009918267011045620188023231884283364","240019402275460157740975095727168640207","276498128064374268632420638483112505272","137378813570596590094778362080755671176","90106377484174975455564131918402057136","246524809232248934677036880304414481783","154143101464377361727192659246603798336","260209376952421620784922819647176959460","291141292063522259182343516414589168415","162480651783845066865615586681150249582","57312628845008765872537774812971030170"]},"target":{"file":"drm/1.0/default/CryptoPlugin.cpp"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-176444161.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9:0"},{"fixed":"9:2021-06-01"}]}],"versions":["9"],"ecosystem_specific":{"spl":"2021-06-01","fixes":["https://android.googlesource.com/platform/frameworks/av/+/7a398e7291b3da1c9b7c924d2301a749daedbd41"],"severity":"High","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/7a398e7291b3da1c9b7c924d2301a749daedbd41","target":{"function":"CryptoPlugin::decrypt","file":"drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp"},"id":"ASB-A-176444161-2175abe7","digest":{"function_hash":"85000199984874211656487740661554914365","length":4251},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/7a398e7291b3da1c9b7c924d2301a749daedbd41","id":"ASB-A-176444161-24e1e172","digest":{"function_hash":"83804324151596417791924039404182904851","length":233},"target":{"function":"CryptoPlugin::setSharedBufferBase","file":"drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp"},"deprecated":false},{"target":{"file":"drm/mediadrm/plugins/clearkey/hidl/include/CryptoPlugin.h"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/7a398e7291b3da1c9b7c924d2301a749daedbd41","signature_type":"Line","id":"ASB-A-176444161-50a8ebe0","digest":{"threshold":0.9,"line_hashes":["285432182521900766634600937648686519205","311646540107077145865442442676019847568","329698376950858297192832384173979819014","146575468195616159124939044224128084244","17228299505471295785036823491755842688","94346791918600999099143623760642518438","51927084357953575189127312641109951261","198714713846547538751318032688264765306","69912771190499630331467339225644523023","329417660113387093181582154380534886800","174697306043221093471911081739033742820"]},"deprecated":false},{"target":{"file":"drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/7a398e7291b3da1c9b7c924d2301a749daedbd41","signature_type":"Line","id":"ASB-A-176444161-511bdc39","digest":{"threshold":0.9,"line_hashes":["80650755198225489646155818328579013244","214302883976724642944160823531773350831","228857402668709192371015871719057283554","216796585859875414685283691379126266480","113695410270198154705969279197808309804","184906685166711465071888600517307342760","264298949911011163485260866338663751604","182509013215656757272313039702013762214","79868785389749169529183912015347522416"]},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-176444161.json"}},{"package":{"name":"platform/hardware/interfaces","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9:0"},{"fixed":"9:2021-06-01"}]}],"versions":["9"],"ecosystem_specific":{"spl":"2021-06-01","fixes":["https://android.googlesource.com/platform/hardware/interfaces/+/ae1c624ba44ccc43dc8371328a4b3caa017c0ff8"],"severity":"High","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/interfaces/+/ae1c624ba44ccc43dc8371328a4b3caa017c0ff8","deprecated":false,"target":{"file":"drm/1.0/default/CryptoPlugin.h"},"id":"ASB-A-176444161-48cf2f56","digest":{"threshold":0.9,"line_hashes":["338734003058650768117569873538913139211","48334840324752538220133656459956211134","74219866353171461841539864830050274457","222290197317652465409581001700111359761","87089908589932915432556193581794380754","54706185110868442096262177696595696279","324607132481506265150981429704786906864","136556778993816125910016875516885690619","68342775054458916267650814659772342317","303034744072508462164836128000890610502","298561505625679081913440228746743709653","244686149178940169759062632632814000223","326167035501015315238203021377548683500","199164574376375895138658068341247569159","173622098562518735989600364692111324601","8820646153323049783395416090839125310","61786442267307842068128269464010653229","184832951823819122292927511161264090234","18208972824218449988403253158397327668"]}},{"target":{"function":"CryptoPlugin::setSharedBufferBase","file":"drm/1.0/default/CryptoPlugin.cpp"},"signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/interfaces/+/ae1c624ba44ccc43dc8371328a4b3caa017c0ff8","signature_type":"Function","id":"ASB-A-176444161-74da0671","digest":{"function_hash":"83804324151596417791924039404182904851","length":233},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/interfaces/+/ae1c624ba44ccc43dc8371328a4b3caa017c0ff8","deprecated":false,"target":{"file":"drm/1.0/default/CryptoPlugin.cpp"},"id":"ASB-A-176444161-db5cc869","digest":{"threshold":0.9,"line_hashes":["221586211301701561923541131000659257682","214302883976724642944160823531773350831","228857402668709192371015871719057283554","178009918267011045620188023231884283364","240019402275460157740975095727168640207","276498128064374268632420638483112505272","114433394657626372821910648266472716077","291141292063522259182343516414589168415","973311319970186573685297772982176662","198449186455470176282285785883624712342"]}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-176444161.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2021-06-01"}]}],"versions":["10"],"ecosystem_specific":{"spl":"2021-06-01","fixes":["https://android.googlesource.com/platform/frameworks/av/+/abb7ad47b00ae158eded8813801345d91d2b2671"],"severity":"High","types":["EoP"],"vanir_signatures":[{"target":{"file":"drm/mediadrm/plugins/clearkey/hidl/include/CryptoPlugin.h"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/abb7ad47b00ae158eded8813801345d91d2b2671","signature_type":"Line","id":"ASB-A-176444161-26f7068d","digest":{"threshold":0.9,"line_hashes":["239931648519675499196978260866577697191","101128053027266173697275272088818991632","329698376950858297192832384173979819014","153117273229964002442024244984841189871","193655110644763919988885454820860265412","207649455538724743432156768924033261911","299081592202751204780576662467884825169","198714713846547538751318032688264765306","69912771190499630331467339225644523023","329417660113387093181582154380534886800","174697306043221093471911081739033742820"]},"deprecated":false},{"target":{"function":"CryptoPlugin::decrypt_1_2","file":"drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/abb7ad47b00ae158eded8813801345d91d2b2671","signature_type":"Function","id":"ASB-A-176444161-366640d9","digest":{"function_hash":"289247886596900951187087052811627073121","length":4254},"deprecated":false},{"target":{"file":"drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/abb7ad47b00ae158eded8813801345d91d2b2671","signature_type":"Line","id":"ASB-A-176444161-6d1522e4","digest":{"threshold":0.9,"line_hashes":["80650755198225489646155818328579013244","214302883976724642944160823531773350831","228857402668709192371015871719057283554","216796585859875414685283691379126266480","133042071211530628408949559588741735994","314602904450202568066777898281698976547","264298949911011163485260866338663751604","182509013215656757272313039702013762214","79868785389749169529183912015347522416"]},"deprecated":false},{"target":{"function":"CryptoPlugin::setSharedBufferBase","file":"drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/abb7ad47b00ae158eded8813801345d91d2b2671","signature_type":"Function","id":"ASB-A-176444161-6d237fec","digest":{"function_hash":"83804324151596417791924039404182904851","length":233},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-176444161.json"}},{"package":{"name":"platform/hardware/interfaces","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2021-06-01"}]}],"versions":["10"],"ecosystem_specific":{"spl":"2021-06-01","fixes":["https://android.googlesource.com/platform/hardware/interfaces/+/9fcd4886a3e1ccbc18acfadd84906400c9882eda"],"severity":"High","types":["EoP"],"vanir_signatures":[{"target":{"function":"CryptoPlugin::setSharedBufferBase","file":"drm/1.0/default/CryptoPlugin.cpp"},"signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/interfaces/+/9fcd4886a3e1ccbc18acfadd84906400c9882eda","signature_type":"Function","id":"ASB-A-176444161-4c939cb1","digest":{"function_hash":"30327710380002908183031134057555754975","length":173},"deprecated":false},{"target":{"file":"drm/1.0/default/CryptoPlugin.h"},"signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/interfaces/+/9fcd4886a3e1ccbc18acfadd84906400c9882eda","signature_type":"Line","id":"ASB-A-176444161-4e6da6c3","digest":{"threshold":0.9,"line_hashes":["338734003058650768117569873538913139211","48334840324752538220133656459956211134","74219866353171461841539864830050274457","222290197317652465409581001700111359761","87089908589932915432556193581794380754","54706185110868442096262177696595696279","324607132481506265150981429704786906864","136556778993816125910016875516885690619","68342775054458916267650814659772342317","303034744072508462164836128000890610502","298561505625679081913440228746743709653","244686149178940169759062632632814000223","326167035501015315238203021377548683500","199164574376375895138658068341247569159","173622098562518735989600364692111324601","8820646153323049783395416090839125310","61786442267307842068128269464010653229","184832951823819122292927511161264090234","18208972824218449988403253158397327668"]},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/interfaces/+/9fcd4886a3e1ccbc18acfadd84906400c9882eda","target":{"file":"drm/1.0/default/CryptoPlugin.cpp"},"id":"ASB-A-176444161-6a2a9b79","digest":{"threshold":0.9,"line_hashes":["332590428842297416598272175294071262211","112520708469331746017134768630155321874","101135519993293756381725003488514858462","178009918267011045620188023231884283364","240019402275460157740975095727168640207","276498128064374268632420638483112505272","137378813570596590094778362080755671176","90106377484174975455564131918402057136","246524809232248934677036880304414481783","154143101464377361727192659246603798336","114433394657626372821910648266472716077","291141292063522259182343516414589168415","973311319970186573685297772982176662","198449186455470176282285785883624712342"]},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-176444161.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2021-06-01"}]}],"versions":["11"],"ecosystem_specific":{"spl":"2021-06-01","fixes":["https://android.googlesource.com/platform/frameworks/av/+/79a6ffbdaf14cfbb597efd8545ba401f1da28a4f"],"severity":"High","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/79a6ffbdaf14cfbb597efd8545ba401f1da28a4f","deprecated":false,"target":{"function":"CryptoPlugin::decrypt_1_2","file":"drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp"},"id":"ASB-A-176444161-0b377d6c","digest":{"function_hash":"289247886596900951187087052811627073121","length":4254}},{"target":{"file":"drm/mediadrm/plugins/clearkey/hidl/include/CryptoPlugin.h"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/79a6ffbdaf14cfbb597efd8545ba401f1da28a4f","signature_type":"Line","id":"ASB-A-176444161-26761c2c","digest":{"threshold":0.9,"line_hashes":["239931648519675499196978260866577697191","101128053027266173697275272088818991632","329698376950858297192832384173979819014","153117273229964002442024244984841189871","193655110644763919988885454820860265412","207649455538724743432156768924033261911","299081592202751204780576662467884825169","198714713846547538751318032688264765306","69912771190499630331467339225644523023","329417660113387093181582154380534886800","174697306043221093471911081739033742820"]},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/79a6ffbdaf14cfbb597efd8545ba401f1da28a4f","target":{"function":"CryptoPlugin::setSharedBufferBase","file":"drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp"},"id":"ASB-A-176444161-307f4efb","digest":{"function_hash":"83804324151596417791924039404182904851","length":233},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/79a6ffbdaf14cfbb597efd8545ba401f1da28a4f","id":"ASB-A-176444161-859be51c","digest":{"threshold":0.9,"line_hashes":["80650755198225489646155818328579013244","214302883976724642944160823531773350831","228857402668709192371015871719057283554","216796585859875414685283691379126266480","133042071211530628408949559588741735994","314602904450202568066777898281698976547","264298949911011163485260866338663751604","182509013215656757272313039702013762214","79868785389749169529183912015347522416"]},"target":{"file":"drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-176444161.json"}},{"package":{"name":"platform/hardware/interfaces","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2021-06-01"}]}],"versions":["11"],"ecosystem_specific":{"spl":"2021-06-01","fixes":["https://android.googlesource.com/platform/hardware/interfaces/+/a4e76aab230a565dd0cef11e2e6e2d782b685327"],"severity":"High","types":["EoP"],"vanir_signatures":[{"target":{"file":"drm/1.0/default/CryptoPlugin.h"},"signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/interfaces/+/a4e76aab230a565dd0cef11e2e6e2d782b685327","signature_type":"Line","id":"ASB-A-176444161-3bef26e7","digest":{"threshold":0.9,"line_hashes":["338734003058650768117569873538913139211","48334840324752538220133656459956211134","74219866353171461841539864830050274457","222290197317652465409581001700111359761","87089908589932915432556193581794380754","54706185110868442096262177696595696279","324607132481506265150981429704786906864","136556778993816125910016875516885690619","68342775054458916267650814659772342317","303034744072508462164836128000890610502","298561505625679081913440228746743709653","244686149178940169759062632632814000223","326167035501015315238203021377548683500","199164574376375895138658068341247569159","173622098562518735989600364692111324601","8820646153323049783395416090839125310","61786442267307842068128269464010653229","184832951823819122292927511161264090234","18208972824218449988403253158397327668"]},"deprecated":false},{"target":{"function":"CryptoPlugin::setSharedBufferBase","file":"drm/1.0/default/CryptoPlugin.cpp"},"signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/interfaces/+/a4e76aab230a565dd0cef11e2e6e2d782b685327","signature_type":"Function","id":"ASB-A-176444161-87bb82da","digest":{"function_hash":"30327710380002908183031134057555754975","length":173},"deprecated":false},{"target":{"file":"drm/1.0/default/CryptoPlugin.cpp"},"signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/interfaces/+/a4e76aab230a565dd0cef11e2e6e2d782b685327","signature_type":"Line","id":"ASB-A-176444161-a0b35baf","digest":{"threshold":0.9,"line_hashes":["332590428842297416598272175294071262211","112520708469331746017134768630155321874","101135519993293756381725003488514858462","178009918267011045620188023231884283364","240019402275460157740975095727168640207","276498128064374268632420638483112505272","137378813570596590094778362080755671176","90106377484174975455564131918402057136","246524809232248934677036880304414481783","154143101464377361727192659246603798336","114433394657626372821910648266472716077","291141292063522259182343516414589168415","973311319970186573685297772982176662","198449186455470176282285785883624712342"]},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-176444161.json"}}],"schema_version":"1.7.5"}