{"id":"ASB-A-176919394","details":"In qtaguid_untag of xt_qtaguid.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-176919394","CVE-2021-0399"],"modified":"2026-07-08T15:24:28.874761715Z","published":"2021-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2021-03-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/c2ab93b45b5cdc426868fb8793ada2cac20568ef"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/df8ce9235e1d1e7d46904bfdbf715aa2c62c0b7e"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/964d3c5a33b1f899a79f55741f9660b7ed2e9c83"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/3bb3f19d2f63a4c559645abef673a7ca25b149b7"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/8f9138d6c464a60f37f1b293bc61ccbcce6210f6"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/9290e39a55a98d1788f4d532333bd58b1acf0e10"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/b89f039e8218beb29c06bb7e957c4eb57bbcdecc"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/2bd81ced0685922df12f4be3338ea632805624e9"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2021-03-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/kernel/common/+/df8ce9235e1d1e7d46904bfdbf715aa2c62c0b7e","signature_version":"v1","signature_type":"Line","deprecated":false,"digest":{"line_hashes":["92360495398636792176406546966757924225","102855977441865370861986259867660240207","31282538023324945392025687370956578747","239699027772273096232575130703797632606","268465686708601018015124414172962347656","205144268850783558068278548897086870471","59594931387502679787218910298327066007","251433835701724304572176599635525977821","254847197982937906578928464289878670754","163364177549421917427061029309898663933","290098872090137009112042818356296424907"],"threshold":0.9},"target":{"file":"net/netfilter/xt_qtaguid.c"},"id":"ASB-A-176919394-01057f18"},{"source":"https://android.googlesource.com/kernel/common/+/8f9138d6c464a60f37f1b293bc61ccbcce6210f6","signature_version":"v1","signature_type":"Line","deprecated":false,"digest":{"line_hashes":["92360495398636792176406546966757924225","102855977441865370861986259867660240207","31282538023324945392025687370956578747","239699027772273096232575130703797632606","268465686708601018015124414172962347656","205144268850783558068278548897086870471","59594931387502679787218910298327066007","251433835701724304572176599635525977821","254847197982937906578928464289878670754","163364177549421917427061029309898663933","290098872090137009112042818356296424907"],"threshold":0.9},"target":{"file":"net/netfilter/xt_qtaguid.c"},"id":"ASB-A-176919394-038482b0"},{"signature_version":"v1","signature_type":"Line","source":"https://android.googlesource.com/kernel/common/+/b89f039e8218beb29c06bb7e957c4eb57bbcdecc","deprecated":false,"digest":{"line_hashes":["92360495398636792176406546966757924225","102855977441865370861986259867660240207","31282538023324945392025687370956578747","239699027772273096232575130703797632606","268465686708601018015124414172962347656","205144268850783558068278548897086870471","59594931387502679787218910298327066007","251433835701724304572176599635525977821","254847197982937906578928464289878670754","163364177549421917427061029309898663933","290098872090137009112042818356296424907"],"threshold":0.9},"target":{"file":"net/netfilter/xt_qtaguid.c"},"id":"ASB-A-176919394-1bf4526e"},{"deprecated":false,"source":"https://android.googlesource.com/kernel/common/+/c2ab93b45b5cdc426868fb8793ada2cac20568ef","signature_type":"Function","signature_version":"v1","digest":{"length":1221,"function_hash":"296515043061779446035691564728054954367"},"target":{"file":"net/netfilter/xt_qtaguid.c","function":"qtaguid_untag"},"id":"ASB-A-176919394-1f004dab"},{"deprecated":false,"source":"https://android.googlesource.com/kernel/common/+/964d3c5a33b1f899a79f55741f9660b7ed2e9c83","signature_type":"Line","signature_version":"v1","digest":{"line_hashes":["92360495398636792176406546966757924225","102855977441865370861986259867660240207","31282538023324945392025687370956578747","239699027772273096232575130703797632606","268465686708601018015124414172962347656","205144268850783558068278548897086870471","59594931387502679787218910298327066007","251433835701724304572176599635525977821","254847197982937906578928464289878670754","163364177549421917427061029309898663933","290098872090137009112042818356296424907"],"threshold":0.9},"target":{"file":"net/netfilter/xt_qtaguid.c"},"id":"ASB-A-176919394-266766dd"},{"deprecated":false,"source":"https://android.googlesource.com/kernel/common/+/8f9138d6c464a60f37f1b293bc61ccbcce6210f6","signature_type":"Function","signature_version":"v1","digest":{"length":1221,"function_hash":"296515043061779446035691564728054954367"},"target":{"file":"net/netfilter/xt_qtaguid.c","function":"qtaguid_untag"},"id":"ASB-A-176919394-3700358f"},{"deprecated":false,"source":"https://android.googlesource.com/kernel/common/+/9290e39a55a98d1788f4d532333bd58b1acf0e10","signature_type":"Line","signature_version":"v1","target":{"file":"net/netfilter/xt_qtaguid.c"},"digest":{"line_hashes":["92360495398636792176406546966757924225","102855977441865370861986259867660240207","31282538023324945392025687370956578747","239699027772273096232575130703797632606","268465686708601018015124414172962347656","205144268850783558068278548897086870471","59594931387502679787218910298327066007","251433835701724304572176599635525977821","254847197982937906578928464289878670754","163364177549421917427061029309898663933","290098872090137009112042818356296424907"],"threshold":0.9},"id":"ASB-A-176919394-5c3c8695"},{"deprecated":false,"source":"https://android.googlesource.com/kernel/common/+/2bd81ced0685922df12f4be3338ea632805624e9","signature_type":"Function","signature_version":"v1","digest":{"length":1221,"function_hash":"296515043061779446035691564728054954367"},"target":{"file":"net/netfilter/xt_qtaguid.c","function":"qtaguid_untag"},"id":"ASB-A-176919394-6d273b96"},{"signature_type":"Line","deprecated":false,"source":"https://android.googlesource.com/kernel/common/+/c2ab93b45b5cdc426868fb8793ada2cac20568ef","signature_version":"v1","digest":{"line_hashes":["92360495398636792176406546966757924225","102855977441865370861986259867660240207","31282538023324945392025687370956578747","239699027772273096232575130703797632606","268465686708601018015124414172962347656","205144268850783558068278548897086870471","59594931387502679787218910298327066007","251433835701724304572176599635525977821","254847197982937906578928464289878670754","163364177549421917427061029309898663933","290098872090137009112042818356296424907"],"threshold":0.9},"target":{"file":"net/netfilter/xt_qtaguid.c"},"id":"ASB-A-176919394-933d1983"},{"signature_version":"v1","signature_type":"Function","source":"https://android.googlesource.com/kernel/common/+/df8ce9235e1d1e7d46904bfdbf715aa2c62c0b7e","deprecated":false,"digest":{"length":1221,"function_hash":"296515043061779446035691564728054954367"},"target":{"file":"net/netfilter/xt_qtaguid.c","function":"qtaguid_untag"},"id":"ASB-A-176919394-9a699e3b"},{"deprecated":false,"source":"https://android.googlesource.com/kernel/common/+/964d3c5a33b1f899a79f55741f9660b7ed2e9c83","signature_type":"Function","signature_version":"v1","digest":{"length":1221,"function_hash":"296515043061779446035691564728054954367"},"target":{"file":"net/netfilter/xt_qtaguid.c","function":"qtaguid_untag"},"id":"ASB-A-176919394-a03ea69b"},{"deprecated":false,"source":"https://android.googlesource.com/kernel/common/+/3bb3f19d2f63a4c559645abef673a7ca25b149b7","signature_type":"Line","signature_version":"v1","digest":{"line_hashes":["92360495398636792176406546966757924225","102855977441865370861986259867660240207","31282538023324945392025687370956578747","239699027772273096232575130703797632606","268465686708601018015124414172962347656","205144268850783558068278548897086870471","59594931387502679787218910298327066007","251433835701724304572176599635525977821","254847197982937906578928464289878670754","163364177549421917427061029309898663933","290098872090137009112042818356296424907"],"threshold":0.9},"target":{"file":"net/netfilter/xt_qtaguid.c"},"id":"ASB-A-176919394-b0551564"},{"signature_version":"v1","signature_type":"Function","source":"https://android.googlesource.com/kernel/common/+/9290e39a55a98d1788f4d532333bd58b1acf0e10","deprecated":false,"digest":{"length":1221,"function_hash":"296515043061779446035691564728054954367"},"target":{"file":"net/netfilter/xt_qtaguid.c","function":"qtaguid_untag"},"id":"ASB-A-176919394-bbeec7ab"},{"source":"https://android.googlesource.com/kernel/common/+/2bd81ced0685922df12f4be3338ea632805624e9","signature_version":"v1","signature_type":"Line","deprecated":false,"digest":{"line_hashes":["92360495398636792176406546966757924225","102855977441865370861986259867660240207","31282538023324945392025687370956578747","239699027772273096232575130703797632606","268465686708601018015124414172962347656","205144268850783558068278548897086870471","59594931387502679787218910298327066007","251433835701724304572176599635525977821","254847197982937906578928464289878670754","163364177549421917427061029309898663933","290098872090137009112042818356296424907"],"threshold":0.9},"target":{"file":"net/netfilter/xt_qtaguid.c"},"id":"ASB-A-176919394-e299c05d"},{"deprecated":false,"source":"https://android.googlesource.com/kernel/common/+/b89f039e8218beb29c06bb7e957c4eb57bbcdecc","signature_type":"Function","signature_version":"v1","digest":{"length":1221,"function_hash":"296515043061779446035691564728054954367"},"target":{"file":"net/netfilter/xt_qtaguid.c","function":"qtaguid_untag"},"id":"ASB-A-176919394-efb35aad"},{"deprecated":false,"source":"https://android.googlesource.com/kernel/common/+/3bb3f19d2f63a4c559645abef673a7ca25b149b7","signature_type":"Function","signature_version":"v1","digest":{"length":1221,"function_hash":"296515043061779446035691564728054954367"},"target":{"file":"net/netfilter/xt_qtaguid.c","function":"qtaguid_untag"},"id":"ASB-A-176919394-fc36d934"}],"severity":"High","spl":"2021-03-05","fixes":["https://android.googlesource.com/kernel/common/+/c2ab93b45b5cdc426868fb8793ada2cac20568ef","https://android.googlesource.com/kernel/common/+/df8ce9235e1d1e7d46904bfdbf715aa2c62c0b7e","https://android.googlesource.com/kernel/common/+/964d3c5a33b1f899a79f55741f9660b7ed2e9c83","https://android.googlesource.com/kernel/common/+/3bb3f19d2f63a4c559645abef673a7ca25b149b7","https://android.googlesource.com/kernel/common/+/8f9138d6c464a60f37f1b293bc61ccbcce6210f6","https://android.googlesource.com/kernel/common/+/9290e39a55a98d1788f4d532333bd58b1acf0e10","https://android.googlesource.com/kernel/common/+/b89f039e8218beb29c06bb7e957c4eb57bbcdecc","https://android.googlesource.com/kernel/common/+/2bd81ced0685922df12f4be3338ea632805624e9"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-176919394.json"}}],"schema_version":"1.7.5"}