{"id":"ASB-A-193149550","details":"In NotificationStackScrollLayout of NotificationStackScrollLayout.java, there is a possible way to bypass Factory Reset Protections. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-193149550","CVE-2021-0957"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2022-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-03-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/e4d9de5961d9ec2fa9dc7103e4eb652e60d624c3"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2022-03-01"}]}],"versions":["10"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e7f992a1338150a669f1c015292f26d0833c386d","https://android.googlesource.com/platform/frameworks/base/+/4ac20f1255fb30e94e1d29e56579f1409922763c"],"severity":"High","spl":"2022-03-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e7f992a1338150a669f1c015292f26d0833c386d","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayout.java"},"deprecated":false,"digest":{"line_hashes":["87010593526676692379410901582635891723","232795265767612072120738704817538181567","316707934239402544599592353103860133884","267986872574156801922795456173490442836","213450213697840901732222691557898546822","184340312194865643355962764125208297215","306022883008791212173594754547402794788","260426784142123448781654276210925435072","205734603055626166706930526918650416589","20872685463208887546637351202706046234","67873610866928942245031259839948504953","87896431047955155075894511181766274391","155191433189798323597833849238903922450","210563052952469090489674899060045489999","297753909427518954479260443585110964061","157686177486111050769713772842090565669","38383041265437388453611352359717816982","254525470130617091946706584031393334825","27929752468522349677460782069497562959","74386586028549653723381943021644182803","321762546560953665546295363829854711029","50959302441890965564970523503184126836"],"threshold":0.9},"id":"ASB-A-193149550-466ee770"},{"deprecated":false,"digest":{"length":3000,"function_hash":"131024002804271812125022037632305205915"},"id":"ASB-A-193149550-7e5b3218","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e7f992a1338150a669f1c015292f26d0833c386d","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayout.java","function":"NotificationStackScrollLayout"}},{"deprecated":false,"digest":{"function_hash":"246618119653620674153370259762503155516","length":318},"id":"ASB-A-193149550-9bbd4aea","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4ac20f1255fb30e94e1d29e56579f1409922763c","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayout.java","function":"updateFooter"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e7f992a1338150a669f1c015292f26d0833c386d","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayout.java","function":"updateFooter"},"deprecated":false,"digest":{"function_hash":"41993445866684859065458067406897664585","length":295},"id":"ASB-A-193149550-9c89498d","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["222268980553295239967153354714034460739","19687750427230114327746695609144045914","229599415382686224468461603646246310422","157686177486111050769713772842090565669"],"threshold":0.9},"id":"ASB-A-193149550-c144fe4b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4ac20f1255fb30e94e1d29e56579f1409922763c","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayout.java"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-193149550.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2022-03-01"}]}],"versions":["11"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"252445086708353490571330433934165733402","length":449},"id":"ASB-A-193149550-036a4cbc","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/73c3c0a7d649b725da0459cc55c6418e0f2ba175","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayout.java","function":"updateFooter"}},{"target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayout.java","function":"NotificationStackScrollLayout"},"deprecated":false,"digest":{"length":4208,"function_hash":"208864997321185936399206813889830644735"},"id":"ASB-A-193149550-0898f937","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/73c3c0a7d649b725da0459cc55c6418e0f2ba175"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/73c3c0a7d649b725da0459cc55c6418e0f2ba175","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayout.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["87010593526676692379410901582635891723","232795265767612072120738704817538181567","316707934239402544599592353103860133884","111975051445677286828951957252031492779","213450213697840901732222691557898546822","184340312194865643355962764125208297215","306022883008791212173594754547402794788","260426784142123448781654276210925435072","27178844022411051148680602026969548754","250149322649816326234765767310836683424","166151291362752591901017795084780207342","224283557217349177531218112059065064620","99846109513518316947371145351526789111","77960953941145877182899533742645626521","211873404982813792217997230253182007993","8490661010950057844573090572491252277","335974680597033918862169200221264219733","139394306180295080530405207448655261682","211653745418657532232387290943304039606","308001022240627281772848985674239205320","167178117866850955416957668639927858025","50959302441890965564970523503184126836"]},"id":"ASB-A-193149550-b8df982d","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/73c3c0a7d649b725da0459cc55c6418e0f2ba175"],"severity":"High","spl":"2022-03-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-193149550.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2022-03-01"}]}],"versions":["12"],"ecosystem_specific":{"spl":"2022-03-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["143558391698001325192063716936616595492","187569267052891346786838726350967210092","171108016818494876164737518317268910248","128260591610457117613272532312144981786","40273060775319047533177427022097850337","143685069525577020112382061103782324515","167816446933545423429732825100290968713","111505897858724502378296417147747228848","203513515715097285743324054675657403794","37526447104540943209961362227591151494","198550423490576472226516812010247410723","163958586707954738466221570956801835127","200655743114107538171434030324360751024","315293722438911441863766802530595995489","33061349163946669415579176812178848696","274149281745922603922902583043151014344","47260388914137165651605970076282537696","4704283431722294842588412141634682575","14195338584900463511441805515726278335","221585379972432888451179945288860221295","37429180100565731044488384328999277683","282431890268466209744270640958560388220"],"threshold":0.9},"id":"ASB-A-193149550-930b3a93","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e4d9de5961d9ec2fa9dc7103e4eb652e60d624c3","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayoutController.java"}},{"id":"ASB-A-193149550-96c7228c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e4d9de5961d9ec2fa9dc7103e4eb652e60d624c3","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayoutController.java","function":"NotificationStackScrollLayoutController"},"deprecated":false,"digest":{"function_hash":"235401675590705231038785787001601606127","length":2022}},{"id":"ASB-A-193149550-ad4bc20a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e4d9de5961d9ec2fa9dc7103e4eb652e60d624c3","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayoutController.java","function":"attach"},"deprecated":false,"digest":{"function_hash":"249904664713745630605940456218283533483","length":2933}},{"target":{"function":"updateFooter","file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayout.java"},"deprecated":false,"digest":{"length":562,"function_hash":"289636412927987397922378462739113152917"},"id":"ASB-A-193149550-e82f85e0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e4d9de5961d9ec2fa9dc7103e4eb652e60d624c3"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/e4d9de5961d9ec2fa9dc7103e4eb652e60d624c3","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayout.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["213450213697840901732222691557898546822","184340312194865643355962764125208297215","306022883008791212173594754547402794788","260426784142123448781654276210925435072","199742608222636653601593233832430714892","137129910952085850251880082896808093169","49045120980167279113834053822704831096","282603271434357452173541367675119740607","275268349457544285692983751882274061502","243137376970408764623169651086284846217","50959302441890965564970523503184126836"]},"id":"ASB-A-193149550-f7c3c6fa","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e4d9de5961d9ec2fa9dc7103e4eb652e60d624c3"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-193149550.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-03-01"}]}],"versions":["12L"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/33b92965da7608bf78037b1ddf23468211c2d176","target":{"function":"updateFooter","file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayout.java"},"deprecated":false,"digest":{"length":562,"function_hash":"289636412927987397922378462739113152917"},"id":"ASB-A-193149550-9ea1dc8b","signature_type":"Function"},{"id":"ASB-A-193149550-9f576915","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/33b92965da7608bf78037b1ddf23468211c2d176","target":{"function":"attach","file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayoutController.java"},"deprecated":false,"digest":{"function_hash":"249904664713745630605940456218283533483","length":2933}},{"id":"ASB-A-193149550-dd8f5708","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/33b92965da7608bf78037b1ddf23468211c2d176","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayoutController.java","function":"NotificationStackScrollLayoutController"},"deprecated":false,"digest":{"function_hash":"235401675590705231038785787001601606127","length":2022}},{"target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayout.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["213450213697840901732222691557898546822","184340312194865643355962764125208297215","306022883008791212173594754547402794788","260426784142123448781654276210925435072","199742608222636653601593233832430714892","137129910952085850251880082896808093169","49045120980167279113834053822704831096","282603271434357452173541367675119740607","275268349457544285692983751882274061502","243137376970408764623169651086284846217","50959302441890965564970523503184126836"]},"id":"ASB-A-193149550-e0315224","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/33b92965da7608bf78037b1ddf23468211c2d176"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/33b92965da7608bf78037b1ddf23468211c2d176","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayoutController.java"},"deprecated":false,"digest":{"line_hashes":["143558391698001325192063716936616595492","187569267052891346786838726350967210092","171108016818494876164737518317268910248","128260591610457117613272532312144981786","40273060775319047533177427022097850337","143685069525577020112382061103782324515","167816446933545423429732825100290968713","111505897858724502378296417147747228848","203513515715097285743324054675657403794","37526447104540943209961362227591151494","198550423490576472226516812010247410723","163958586707954738466221570956801835127","200655743114107538171434030324360751024","315293722438911441863766802530595995489","33061349163946669415579176812178848696","274149281745922603922902583043151014344","47260388914137165651605970076282537696","4704283431722294842588412141634682575","14195338584900463511441805515726278335","221585379972432888451179945288860221295","37429180100565731044488384328999277683","282431890268466209744270640958560388220"],"threshold":0.9},"id":"ASB-A-193149550-fb8fa4d3","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/33b92965da7608bf78037b1ddf23468211c2d176"],"severity":"High","spl":"2022-03-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-193149550.json"}}],"schema_version":"1.9.0"}