{"id":"ASB-A-193149550","details":"In NotificationStackScrollLayout of NotificationStackScrollLayout.java, there is a possible way to bypass Factory Reset Protections. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-193149550","CVE-2021-0957"],"modified":"2026-04-07T15:34:34.465012Z","published":"2022-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-03-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/e4d9de5961d9ec2fa9dc7103e4eb652e60d624c3"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2022-03-01"}]}],"versions":["10"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-193149550-466ee770","signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["87010593526676692379410901582635891723","232795265767612072120738704817538181567","316707934239402544599592353103860133884","267986872574156801922795456173490442836","213450213697840901732222691557898546822","184340312194865643355962764125208297215","306022883008791212173594754547402794788","260426784142123448781654276210925435072","205734603055626166706930526918650416589","20872685463208887546637351202706046234","67873610866928942245031259839948504953","87896431047955155075894511181766274391","155191433189798323597833849238903922450","210563052952469090489674899060045489999","297753909427518954479260443585110964061","157686177486111050769713772842090565669","38383041265437388453611352359717816982","254525470130617091946706584031393334825","27929752468522349677460782069497562959","74386586028549653723381943021644182803","321762546560953665546295363829854711029","50959302441890965564970523503184126836"]},"source":"https://android.googlesource.com/platform/frameworks/base/+/e7f992a1338150a669f1c015292f26d0833c386d","deprecated":false,"target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayout.java"},"signature_version":"v1"},{"id":"ASB-A-193149550-7e5b3218","signature_type":"Function","digest":{"length":3000,"function_hash":"131024002804271812125022037632305205915"},"source":"https://android.googlesource.com/platform/frameworks/base/+/e7f992a1338150a669f1c015292f26d0833c386d","deprecated":false,"target":{"function":"NotificationStackScrollLayout","file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayout.java"},"signature_version":"v1"},{"id":"ASB-A-193149550-9bbd4aea","signature_type":"Function","digest":{"length":318,"function_hash":"246618119653620674153370259762503155516"},"source":"https://android.googlesource.com/platform/frameworks/base/+/4ac20f1255fb30e94e1d29e56579f1409922763c","deprecated":false,"target":{"function":"updateFooter","file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayout.java"},"signature_version":"v1"},{"id":"ASB-A-193149550-9c89498d","signature_type":"Function","digest":{"length":295,"function_hash":"41993445866684859065458067406897664585"},"source":"https://android.googlesource.com/platform/frameworks/base/+/e7f992a1338150a669f1c015292f26d0833c386d","deprecated":false,"target":{"function":"updateFooter","file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayout.java"},"signature_version":"v1"},{"id":"ASB-A-193149550-c144fe4b","signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["222268980553295239967153354714034460739","19687750427230114327746695609144045914","229599415382686224468461603646246310422","157686177486111050769713772842090565669"]},"source":"https://android.googlesource.com/platform/frameworks/base/+/4ac20f1255fb30e94e1d29e56579f1409922763c","deprecated":false,"target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayout.java"},"signature_version":"v1"}],"types":["EoP"],"spl":"2022-03-01","severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/e7f992a1338150a669f1c015292f26d0833c386d","https://android.googlesource.com/platform/frameworks/base/+/4ac20f1255fb30e94e1d29e56579f1409922763c"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-193149550.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2022-03-01"}]}],"versions":["11"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-193149550-036a4cbc","signature_type":"Function","digest":{"length":449,"function_hash":"252445086708353490571330433934165733402"},"source":"https://android.googlesource.com/platform/frameworks/base/+/73c3c0a7d649b725da0459cc55c6418e0f2ba175","deprecated":false,"target":{"function":"updateFooter","file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayout.java"},"signature_version":"v1"},{"id":"ASB-A-193149550-0898f937","signature_type":"Function","digest":{"length":4208,"function_hash":"208864997321185936399206813889830644735"},"source":"https://android.googlesource.com/platform/frameworks/base/+/73c3c0a7d649b725da0459cc55c6418e0f2ba175","deprecated":false,"target":{"function":"NotificationStackScrollLayout","file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayout.java"},"signature_version":"v1"},{"id":"ASB-A-193149550-b8df982d","signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["87010593526676692379410901582635891723","232795265767612072120738704817538181567","316707934239402544599592353103860133884","111975051445677286828951957252031492779","213450213697840901732222691557898546822","184340312194865643355962764125208297215","306022883008791212173594754547402794788","260426784142123448781654276210925435072","27178844022411051148680602026969548754","250149322649816326234765767310836683424","166151291362752591901017795084780207342","224283557217349177531218112059065064620","99846109513518316947371145351526789111","77960953941145877182899533742645626521","211873404982813792217997230253182007993","8490661010950057844573090572491252277","335974680597033918862169200221264219733","139394306180295080530405207448655261682","211653745418657532232387290943304039606","308001022240627281772848985674239205320","167178117866850955416957668639927858025","50959302441890965564970523503184126836"]},"source":"https://android.googlesource.com/platform/frameworks/base/+/73c3c0a7d649b725da0459cc55c6418e0f2ba175","deprecated":false,"target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayout.java"},"signature_version":"v1"}],"types":["EoP"],"spl":"2022-03-01","severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/73c3c0a7d649b725da0459cc55c6418e0f2ba175"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-193149550.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2022-03-01"}]}],"versions":["12"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-193149550-930b3a93","signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["143558391698001325192063716936616595492","187569267052891346786838726350967210092","171108016818494876164737518317268910248","128260591610457117613272532312144981786","40273060775319047533177427022097850337","143685069525577020112382061103782324515","167816446933545423429732825100290968713","111505897858724502378296417147747228848","203513515715097285743324054675657403794","37526447104540943209961362227591151494","198550423490576472226516812010247410723","163958586707954738466221570956801835127","200655743114107538171434030324360751024","315293722438911441863766802530595995489","33061349163946669415579176812178848696","274149281745922603922902583043151014344","47260388914137165651605970076282537696","4704283431722294842588412141634682575","14195338584900463511441805515726278335","221585379972432888451179945288860221295","37429180100565731044488384328999277683","282431890268466209744270640958560388220"]},"source":"https://android.googlesource.com/platform/frameworks/base/+/e4d9de5961d9ec2fa9dc7103e4eb652e60d624c3","deprecated":false,"target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayoutController.java"},"signature_version":"v1"},{"id":"ASB-A-193149550-96c7228c","signature_type":"Function","digest":{"length":2022,"function_hash":"235401675590705231038785787001601606127"},"source":"https://android.googlesource.com/platform/frameworks/base/+/e4d9de5961d9ec2fa9dc7103e4eb652e60d624c3","deprecated":false,"target":{"function":"NotificationStackScrollLayoutController","file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayoutController.java"},"signature_version":"v1"},{"id":"ASB-A-193149550-ad4bc20a","signature_type":"Function","digest":{"length":2933,"function_hash":"249904664713745630605940456218283533483"},"source":"https://android.googlesource.com/platform/frameworks/base/+/e4d9de5961d9ec2fa9dc7103e4eb652e60d624c3","deprecated":false,"target":{"function":"attach","file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayoutController.java"},"signature_version":"v1"},{"id":"ASB-A-193149550-e82f85e0","signature_type":"Function","digest":{"length":562,"function_hash":"289636412927987397922378462739113152917"},"source":"https://android.googlesource.com/platform/frameworks/base/+/e4d9de5961d9ec2fa9dc7103e4eb652e60d624c3","deprecated":false,"target":{"function":"updateFooter","file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayout.java"},"signature_version":"v1"},{"id":"ASB-A-193149550-f7c3c6fa","signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["213450213697840901732222691557898546822","184340312194865643355962764125208297215","306022883008791212173594754547402794788","260426784142123448781654276210925435072","199742608222636653601593233832430714892","137129910952085850251880082896808093169","49045120980167279113834053822704831096","282603271434357452173541367675119740607","275268349457544285692983751882274061502","243137376970408764623169651086284846217","50959302441890965564970523503184126836"]},"source":"https://android.googlesource.com/platform/frameworks/base/+/e4d9de5961d9ec2fa9dc7103e4eb652e60d624c3","deprecated":false,"target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayout.java"},"signature_version":"v1"}],"types":["EoP"],"spl":"2022-03-01","severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/e4d9de5961d9ec2fa9dc7103e4eb652e60d624c3"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-193149550.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-03-01"}]}],"versions":["12L"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-193149550-9ea1dc8b","signature_type":"Function","digest":{"length":562,"function_hash":"289636412927987397922378462739113152917"},"source":"https://android.googlesource.com/platform/frameworks/base/+/33b92965da7608bf78037b1ddf23468211c2d176","deprecated":false,"target":{"function":"updateFooter","file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayout.java"},"signature_version":"v1"},{"id":"ASB-A-193149550-9f576915","signature_type":"Function","digest":{"length":2933,"function_hash":"249904664713745630605940456218283533483"},"source":"https://android.googlesource.com/platform/frameworks/base/+/33b92965da7608bf78037b1ddf23468211c2d176","deprecated":false,"target":{"function":"attach","file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayoutController.java"},"signature_version":"v1"},{"id":"ASB-A-193149550-dd8f5708","signature_type":"Function","digest":{"length":2022,"function_hash":"235401675590705231038785787001601606127"},"source":"https://android.googlesource.com/platform/frameworks/base/+/33b92965da7608bf78037b1ddf23468211c2d176","deprecated":false,"target":{"function":"NotificationStackScrollLayoutController","file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayoutController.java"},"signature_version":"v1"},{"id":"ASB-A-193149550-e0315224","signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["213450213697840901732222691557898546822","184340312194865643355962764125208297215","306022883008791212173594754547402794788","260426784142123448781654276210925435072","199742608222636653601593233832430714892","137129910952085850251880082896808093169","49045120980167279113834053822704831096","282603271434357452173541367675119740607","275268349457544285692983751882274061502","243137376970408764623169651086284846217","50959302441890965564970523503184126836"]},"source":"https://android.googlesource.com/platform/frameworks/base/+/33b92965da7608bf78037b1ddf23468211c2d176","deprecated":false,"target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayout.java"},"signature_version":"v1"},{"id":"ASB-A-193149550-fb8fa4d3","signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["143558391698001325192063716936616595492","187569267052891346786838726350967210092","171108016818494876164737518317268910248","128260591610457117613272532312144981786","40273060775319047533177427022097850337","143685069525577020112382061103782324515","167816446933545423429732825100290968713","111505897858724502378296417147747228848","203513515715097285743324054675657403794","37526447104540943209961362227591151494","198550423490576472226516812010247410723","163958586707954738466221570956801835127","200655743114107538171434030324360751024","315293722438911441863766802530595995489","33061349163946669415579176812178848696","274149281745922603922902583043151014344","47260388914137165651605970076282537696","4704283431722294842588412141634682575","14195338584900463511441805515726278335","221585379972432888451179945288860221295","37429180100565731044488384328999277683","282431890268466209744270640958560388220"]},"source":"https://android.googlesource.com/platform/frameworks/base/+/33b92965da7608bf78037b1ddf23468211c2d176","deprecated":false,"target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/stack/NotificationStackScrollLayoutController.java"},"signature_version":"v1"}],"types":["EoP"],"spl":"2022-03-01","severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/33b92965da7608bf78037b1ddf23468211c2d176"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-193149550.json"}}],"schema_version":"1.7.5"}