{"id":"ASB-A-179839665","details":"In TouchInputMapper::sync of TouchInputMapper.cpp, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-179839665","CVE-2021-0684"],"modified":"2026-04-17T15:55:28.020024Z","published":"2021-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2021-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/native/+/737415ddabe33ff5c59e7cfa0b1a529b416a6313"}],"affected":[{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1:0"},{"fixed":"8.1:2021-09-01"}]}],"versions":["8.1"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Line","digest":{"line_hashes":["37453471462408686094850282967217977416","270187484785748654731955850859942230567","192316713145734928722127838181096616821","74126827077068516243974594962935301901"],"threshold":0.9},"target":{"file":"services/inputflinger/InputReader.h"},"signature_version":"v1","deprecated":false,"id":"ASB-A-179839665-2b5e5bfb","source":"https://android.googlesource.com/platform/frameworks/native/+/ade0672333565773645abe89eccc468572c07228"},{"signature_type":"Function","digest":{"function_hash":"26441390556967683605450767544755284036","length":4041},"target":{"file":"services/inputflinger/InputReader.cpp","function":"TouchInputMapper::assignPointerIds"},"signature_version":"v1","deprecated":false,"id":"ASB-A-179839665-5c0bb4b7","source":"https://android.googlesource.com/platform/frameworks/native/+/ade0672333565773645abe89eccc468572c07228"},{"signature_type":"Function","digest":{"function_hash":"210470899102404797474366699497291592512","length":1115},"target":{"file":"services/inputflinger/InputReader.cpp","function":"TouchInputMapper::sync"},"signature_version":"v1","deprecated":false,"id":"ASB-A-179839665-80a72a9a","source":"https://android.googlesource.com/platform/frameworks/native/+/ade0672333565773645abe89eccc468572c07228"},{"signature_type":"Line","digest":{"line_hashes":["140643837928628209673573375492340963356","296983044906620798494120806202603568140","203037264758895446548629013835459589356","165149599217966300726478325849205436423","318977918280431803532690310778364438652","206285575700257427579470810031331572275","267545748434222914387392651717038022213","50562833298505826315429433852085196309","185021482523196094289229054647668139803","94924369466567264828922178443483997629","291840531411921232147201429481383218246","36525787437167887703021825375168302668","16518900792103496046245475937223352544","63782867098257504310039093379668891864","66188051465004491780637135133886828926","125622338799064082109804821779617990332","168483301820792511639232925546204069313","144366005460061164989887734835014734437","208241707527069323221178065573368299502","162827399227369373053858401167197505778","85784337697641226212682558614633393472","249958429779156009063268395118172895742","239021837618226346442350415229040182131","242422034581613374118626160177313911816","74427060116077380053685158409984492626","272265513762207871596034780199447156567","198270760957223187232340386376390182663","313678621018294063274987508478509158255","172171621286474484653553954080891858498","271321110046680157435085023146144114179","249499598351866421542293802279866017930","209420261296387818232243586119044312049","291685069025790728687174477459734158628","149077202909194244688165243510707549087","220830054010147078418202837158138799699","336863639048950303212136240440961840898","110162774519345063988622624221413184449","211401561918479049303112828718067811550","235856174751960840729781675533188635754","172681276032402480950294554633862735072","155827019522860189898352432242140102162","22741435070087111952245796465277784909","154634327493376454094583669915075824266","175423335272657115157328977388527868636","63016536242080060548625588371671041906","52546109095377026088348078937276597818","110924117310725719298194768964532875013","1985021388010178043559187649001641018","59595671047942127212676848350336105541","126308464450753056157597702011082708435","163814413750266509075308024981230282550","88583345744287430870390301145448369840","92163064094201299374315360926219085427","24121345756459837129335070635648544636","333410759938769107983993456862193638886","269825266806564802631727901474632401701","62836141844012902594199506110711687759","189106438882919679409672200945227302023","52394304828616657892773509994369774073","181341768539332933215206481187739626834","158814092822834541596085868212655368777","67543565722585422302967730740754042077","338519794247264037234912154526378991342","142999074789789711869061024133550342884","189106438882919679409672200945227302023","80019505976851895306005292949861712602","302477980538100666982131615290562595522","38219713494086299132365563548828987419"],"threshold":0.9},"target":{"file":"services/inputflinger/InputReader.cpp"},"signature_version":"v1","deprecated":false,"id":"ASB-A-179839665-b84edbd2","source":"https://android.googlesource.com/platform/frameworks/native/+/ade0672333565773645abe89eccc468572c07228"}],"severity":"High","spl":"2021-09-01","types":["EoP"],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/ade0672333565773645abe89eccc468572c07228"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-179839665.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9:0"},{"fixed":"9:2021-09-01"}]}],"versions":["9"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Line","digest":{"line_hashes":["37453471462408686094850282967217977416","270187484785748654731955850859942230567","192316713145734928722127838181096616821","74126827077068516243974594962935301901"],"threshold":0.9},"target":{"file":"services/inputflinger/InputReader.h"},"signature_version":"v1","deprecated":false,"id":"ASB-A-179839665-03fc18bc","source":"https://android.googlesource.com/platform/frameworks/native/+/ade0672333565773645abe89eccc468572c07228"},{"signature_type":"Line","digest":{"line_hashes":["140643837928628209673573375492340963356","296983044906620798494120806202603568140","203037264758895446548629013835459589356","165149599217966300726478325849205436423","318977918280431803532690310778364438652","206285575700257427579470810031331572275","267545748434222914387392651717038022213","50562833298505826315429433852085196309","185021482523196094289229054647668139803","94924369466567264828922178443483997629","291840531411921232147201429481383218246","36525787437167887703021825375168302668","16518900792103496046245475937223352544","63782867098257504310039093379668891864","66188051465004491780637135133886828926","125622338799064082109804821779617990332","168483301820792511639232925546204069313","144366005460061164989887734835014734437","208241707527069323221178065573368299502","162827399227369373053858401167197505778","85784337697641226212682558614633393472","249958429779156009063268395118172895742","239021837618226346442350415229040182131","242422034581613374118626160177313911816","74427060116077380053685158409984492626","272265513762207871596034780199447156567","198270760957223187232340386376390182663","313678621018294063274987508478509158255","172171621286474484653553954080891858498","271321110046680157435085023146144114179","249499598351866421542293802279866017930","209420261296387818232243586119044312049","291685069025790728687174477459734158628","149077202909194244688165243510707549087","220830054010147078418202837158138799699","336863639048950303212136240440961840898","110162774519345063988622624221413184449","211401561918479049303112828718067811550","235856174751960840729781675533188635754","172681276032402480950294554633862735072","155827019522860189898352432242140102162","22741435070087111952245796465277784909","154634327493376454094583669915075824266","175423335272657115157328977388527868636","63016536242080060548625588371671041906","52546109095377026088348078937276597818","110924117310725719298194768964532875013","1985021388010178043559187649001641018","59595671047942127212676848350336105541","126308464450753056157597702011082708435","163814413750266509075308024981230282550","88583345744287430870390301145448369840","92163064094201299374315360926219085427","24121345756459837129335070635648544636","333410759938769107983993456862193638886","269825266806564802631727901474632401701","62836141844012902594199506110711687759","189106438882919679409672200945227302023","52394304828616657892773509994369774073","181341768539332933215206481187739626834","158814092822834541596085868212655368777","67543565722585422302967730740754042077","338519794247264037234912154526378991342","142999074789789711869061024133550342884","189106438882919679409672200945227302023","80019505976851895306005292949861712602","302477980538100666982131615290562595522","38219713494086299132365563548828987419"],"threshold":0.9},"target":{"file":"services/inputflinger/InputReader.cpp"},"signature_version":"v1","deprecated":false,"id":"ASB-A-179839665-0afd0174","source":"https://android.googlesource.com/platform/frameworks/native/+/ade0672333565773645abe89eccc468572c07228"},{"signature_type":"Function","digest":{"function_hash":"210470899102404797474366699497291592512","length":1115},"target":{"file":"services/inputflinger/InputReader.cpp","function":"TouchInputMapper::sync"},"signature_version":"v1","deprecated":false,"id":"ASB-A-179839665-6354e865","source":"https://android.googlesource.com/platform/frameworks/native/+/ade0672333565773645abe89eccc468572c07228"},{"signature_type":"Function","digest":{"function_hash":"26441390556967683605450767544755284036","length":4041},"target":{"file":"services/inputflinger/InputReader.cpp","function":"TouchInputMapper::assignPointerIds"},"signature_version":"v1","deprecated":false,"id":"ASB-A-179839665-ccaba7a1","source":"https://android.googlesource.com/platform/frameworks/native/+/ade0672333565773645abe89eccc468572c07228"}],"severity":"High","spl":"2021-09-01","types":["EoP"],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/ade0672333565773645abe89eccc468572c07228"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-179839665.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2021-09-01"}]}],"versions":["10"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Line","digest":{"line_hashes":["241884886795613663305700001657059519341","199865895155796170188889858879377642818","90248358151693939340768047114819707537","92917675672739599477443057448150144628","301489649842923470789755644856325046311","165197513480219925318191074139139639806","8039462894160351375512447839275483751","50562833298505826315429433852085196309","185021482523196094289229054647668139803","94924369466567264828922178443483997629","291840531411921232147201429481383218246","36525787437167887703021825375168302668","16518900792103496046245475937223352544","63782867098257504310039093379668891864","66188051465004491780637135133886828926","125622338799064082109804821779617990332","168483301820792511639232925546204069313","144366005460061164989887734835014734437","208241707527069323221178065573368299502","162827399227369373053858401167197505778","85784337697641226212682558614633393472","249958429779156009063268395118172895742","239021837618226346442350415229040182131","242422034581613374118626160177313911816","31920734387201257416760189945284937397","199928794576059375444304924414845105177","198270760957223187232340386376390182663","313678621018294063274987508478509158255","172171621286474484653553954080891858498","271321110046680157435085023146144114179","249499598351866421542293802279866017930","209420261296387818232243586119044312049","291685069025790728687174477459734158628","149077202909194244688165243510707549087","220830054010147078418202837158138799699","336863639048950303212136240440961840898","110162774519345063988622624221413184449","211401561918479049303112828718067811550","235856174751960840729781675533188635754","172681276032402480950294554633862735072","155827019522860189898352432242140102162","22741435070087111952245796465277784909","154634327493376454094583669915075824266","175423335272657115157328977388527868636","63016536242080060548625588371671041906","52546109095377026088348078937276597818","110924117310725719298194768964532875013","1985021388010178043559187649001641018","59595671047942127212676848350336105541","126308464450753056157597702011082708435","163814413750266509075308024981230282550","88583345744287430870390301145448369840","92163064094201299374315360926219085427","24121345756459837129335070635648544636","333410759938769107983993456862193638886","269825266806564802631727901474632401701","62836141844012902594199506110711687759","189106438882919679409672200945227302023","52394304828616657892773509994369774073","181341768539332933215206481187739626834","267955277502924505218919998371446349795","67543565722585422302967730740754042077","338519794247264037234912154526378991342","142999074789789711869061024133550342884","189106438882919679409672200945227302023","80019505976851895306005292949861712602","40962265475287505356642477138095983592","190783728334172625006212656508162630392"],"threshold":0.9},"target":{"file":"services/inputflinger/InputReader.cpp"},"signature_version":"v1","deprecated":false,"id":"ASB-A-179839665-23c7ad93","source":"https://android.googlesource.com/platform/frameworks/native/+/beb878bcfb6c7e0cf0954934a0d364a4298eb840"},{"signature_type":"Function","digest":{"function_hash":"297442955698477237370350850625168568854","length":1119},"target":{"file":"services/inputflinger/InputReader.cpp","function":"TouchInputMapper::sync"},"signature_version":"v1","deprecated":false,"id":"ASB-A-179839665-439dfb2d","source":"https://android.googlesource.com/platform/frameworks/native/+/beb878bcfb6c7e0cf0954934a0d364a4298eb840"},{"signature_type":"Line","digest":{"line_hashes":["37453471462408686094850282967217977416","68496236182815934752568072472082797789","204138266688367217935538668821724754917","126518086683465570927371789320191969610"],"threshold":0.9},"target":{"file":"services/inputflinger/InputReader.h"},"signature_version":"v1","deprecated":false,"id":"ASB-A-179839665-7294dc8a","source":"https://android.googlesource.com/platform/frameworks/native/+/beb878bcfb6c7e0cf0954934a0d364a4298eb840"},{"signature_type":"Function","digest":{"function_hash":"288904787576248950631480096017069721113","length":4153},"target":{"file":"services/inputflinger/InputReader.cpp","function":"TouchInputMapper::assignPointerIds"},"signature_version":"v1","deprecated":false,"id":"ASB-A-179839665-cd52379a","source":"https://android.googlesource.com/platform/frameworks/native/+/beb878bcfb6c7e0cf0954934a0d364a4298eb840"}],"severity":"High","spl":"2021-09-01","types":["EoP"],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/beb878bcfb6c7e0cf0954934a0d364a4298eb840"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-179839665.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2021-09-01"}]}],"versions":["11"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Function","digest":{"function_hash":"151043580982549880673561575266047370151","length":1117},"target":{"file":"services/inputflinger/reader/mapper/TouchInputMapper.cpp","function":"TouchInputMapper::sync"},"signature_version":"v1","deprecated":false,"id":"ASB-A-179839665-c8323a7f","source":"https://android.googlesource.com/platform/frameworks/native/+/8cf78f9553981600f57e9c829886848172114484"},{"signature_type":"Function","digest":{"function_hash":"289180077886405751010126479667114575204","length":4151},"target":{"file":"services/inputflinger/reader/mapper/TouchInputMapper.cpp","function":"TouchInputMapper::assignPointerIds"},"signature_version":"v1","deprecated":false,"id":"ASB-A-179839665-c96c7f7c","source":"https://android.googlesource.com/platform/frameworks/native/+/8cf78f9553981600f57e9c829886848172114484"},{"signature_type":"Line","digest":{"line_hashes":["96127459265939697311380192836208065","270187484785748654731955850859942230567","124902081907597841969893592212060302914","28708297609219716142302362792826933651"],"threshold":0.9},"target":{"file":"services/inputflinger/reader/mapper/TouchInputMapper.h"},"signature_version":"v1","deprecated":false,"id":"ASB-A-179839665-e73b2abe","source":"https://android.googlesource.com/platform/frameworks/native/+/8cf78f9553981600f57e9c829886848172114484"},{"signature_type":"Line","digest":{"line_hashes":["215759629146814751277251112413623053815","199865895155796170188889858879377642818","90248358151693939340768047114819707537","92917675672739599477443057448150144628","92954060342116610109038763722624795424","165197513480219925318191074139139639806","137437090326306864895112160712398383162","50562833298505826315429433852085196309","185021482523196094289229054647668139803","94924369466567264828922178443483997629","52074068425549794749585625310628828557","36525787437167887703021825375168302668","16518900792103496046245475937223352544","63782867098257504310039093379668891864","66188051465004491780637135133886828926","210218597954968526638880423767599657094","219069451594436357465575802875667262739","185987381442343244165709524745136387998","188217260784989814055875201909611459615","112286783498416103224112308318896257262","74103088052703790147423980771816344698","31920734387201257416760189945284937397","199928794576059375444304924414845105177","198270760957223187232340386376390182663","313678621018294063274987508478509158255","172171621286474484653553954080891858498","271321110046680157435085023146144114179","249499598351866421542293802279866017930","209420261296387818232243586119044312049","291685069025790728687174477459734158628","149077202909194244688165243510707549087","220830054010147078418202837158138799699","336863639048950303212136240440961840898","110162774519345063988622624221413184449","233513115603663828987695129150341324936","193245114849292788454921978320821160898","20933880952911368353156748113428923987","337070324981819810322504995356371538736","72522980031743569239989601414835027065","175423335272657115157328977388527868636","63016536242080060548625588371671041906","52546109095377026088348078937276597818","110924117310725719298194768964532875013","1985021388010178043559187649001641018","59595671047942127212676848350336105541","126308464450753056157597702011082708435","163814413750266509075308024981230282550","88583345744287430870390301145448369840","92163064094201299374315360926219085427","24121345756459837129335070635648544636","333410759938769107983993456862193638886","269825266806564802631727901474632401701","62836141844012902594199506110711687759","147384213990732893568337655889185303097","66845174856083416162727945864807801823","56296797725611751610176291628005786923","141680074764531124471999971942052793017","290598740354888638485804339797201895067","67543565722585422302967730740754042077","338519794247264037234912154526378991342","142999074789789711869061024133550342884","189106438882919679409672200945227302023","80019505976851895306005292949861712602","40962265475287505356642477138095983592","190783728334172625006212656508162630392"],"threshold":0.9},"target":{"file":"services/inputflinger/reader/mapper/TouchInputMapper.cpp"},"signature_version":"v1","deprecated":false,"id":"ASB-A-179839665-f05f8b63","source":"https://android.googlesource.com/platform/frameworks/native/+/8cf78f9553981600f57e9c829886848172114484"}],"severity":"High","spl":"2021-09-01","types":["EoP"],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/8cf78f9553981600f57e9c829886848172114484"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-179839665.json"}}],"schema_version":"1.7.5"}