{"id":"ASB-A-177611958","details":"In avrc_msg_cback of avrc_api.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-177611958","CVE-2021-0474"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2021-05-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2021-05-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/system/bt/+/2cafe07d66bfc5cc75d7d2bf61415fc33d711132"}],"affected":[{"package":{"name":"platform/system/bt","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1:0"},{"fixed":"8.1:2021-05-01"}]}],"versions":["8.1"],"ecosystem_specific":{"severity":"Critical","spl":"2021-05-01","types":["RCE"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/dc07e927b1272be92095a47634dce0ba3b44b4fd","target":{"function":"avrc_msg_cback","file":"stack/avrc/avrc_api.cc"},"deprecated":false,"digest":{"function_hash":"141229084215930000517804498151885108027","length":6340},"id":"ASB-A-177611958-7705428f","signature_type":"Function"},{"digest":{"line_hashes":["150526927012349828544716931783640751422","149995605094085377647301397251620837487","111438774854508784820030139337456414102","102394801961573258940149572632047047712","136400734491565729666473351706100250063"],"threshold":0.9},"id":"ASB-A-177611958-b535a274","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/dc07e927b1272be92095a47634dce0ba3b44b4fd","target":{"file":"stack/avrc/avrc_api.cc"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/system/bt/+/dc07e927b1272be92095a47634dce0ba3b44b4fd"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-177611958.json"}},{"package":{"name":"platform/system/bt","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9:0"},{"fixed":"9:2021-05-01"}]}],"versions":["9"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/bt/+/dc07e927b1272be92095a47634dce0ba3b44b4fd"],"severity":"Critical","spl":"2021-05-01","types":["RCE"],"vanir_signatures":[{"target":{"file":"stack/avrc/avrc_api.cc"},"deprecated":false,"digest":{"line_hashes":["150526927012349828544716931783640751422","149995605094085377647301397251620837487","111438774854508784820030139337456414102","102394801961573258940149572632047047712","136400734491565729666473351706100250063"],"threshold":0.9},"id":"ASB-A-177611958-575153cc","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/dc07e927b1272be92095a47634dce0ba3b44b4fd"},{"deprecated":false,"digest":{"function_hash":"141229084215930000517804498151885108027","length":6340},"id":"ASB-A-177611958-e8eb4abd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/dc07e927b1272be92095a47634dce0ba3b44b4fd","target":{"file":"stack/avrc/avrc_api.cc","function":"avrc_msg_cback"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-177611958.json"}},{"package":{"name":"platform/system/bt","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2021-05-01"}]}],"versions":["10"],"ecosystem_specific":{"severity":"Critical","spl":"2021-05-01","types":["RCE"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/dc07e927b1272be92095a47634dce0ba3b44b4fd","target":{"file":"stack/avrc/avrc_api.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["150526927012349828544716931783640751422","149995605094085377647301397251620837487","111438774854508784820030139337456414102","102394801961573258940149572632047047712","136400734491565729666473351706100250063"]},"id":"ASB-A-177611958-2b73d814","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/system/bt/+/dc07e927b1272be92095a47634dce0ba3b44b4fd","target":{"file":"stack/avrc/avrc_api.cc","function":"avrc_msg_cback"},"deprecated":false,"digest":{"function_hash":"141229084215930000517804498151885108027","length":6340},"id":"ASB-A-177611958-fd1c531d","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/system/bt/+/dc07e927b1272be92095a47634dce0ba3b44b4fd"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-177611958.json"}},{"package":{"name":"platform/system/bt","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2021-05-01"}]}],"versions":["11"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/bt/+/dc07e927b1272be92095a47634dce0ba3b44b4fd"],"severity":"Critical","spl":"2021-05-01","types":["RCE"],"vanir_signatures":[{"target":{"file":"stack/avrc/avrc_api.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["150526927012349828544716931783640751422","149995605094085377647301397251620837487","111438774854508784820030139337456414102","102394801961573258940149572632047047712","136400734491565729666473351706100250063"]},"id":"ASB-A-177611958-4801e2f8","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/dc07e927b1272be92095a47634dce0ba3b44b4fd"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/dc07e927b1272be92095a47634dce0ba3b44b4fd","target":{"file":"stack/avrc/avrc_api.cc","function":"avrc_msg_cback"},"deprecated":false,"digest":{"length":6340,"function_hash":"141229084215930000517804498151885108027"},"id":"ASB-A-177611958-f68ff08e"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-177611958.json"}}],"schema_version":"1.9.0"}