{"id":"ASB-A-193932765","details":"In RevertActiveSessions of apexd.cpp, there is a possible way to share the wrong file due to an unintentional MediaStore downgrade. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-193932765","CVE-2021-0702"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2021-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2021-10-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/system/apex/+/04bc18a50f900652ff9c07590d12809fc111a451"}],"affected":[{"package":{"name":"platform/system/apex","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12-next:0"},{"fixed":"12-next:2021-10-01"}]}],"versions":["12-next"],"ecosystem_specific":{"types":["ID","Unknown"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/apex/+/85642155eecda9c895283e3050fdb376d92271ae","target":{"file":"apexd/apexservice_test.cpp","function":"TEST_F"},"deprecated":false,"digest":{"function_hash":"4225605585403834167859559494038422097","length":759},"id":"ASB-A-193932765-121d5e3b","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/apex/+/85642155eecda9c895283e3050fdb376d92271ae","target":{"file":"apexd/apexd.cpp","function":"MarkStagedSessionSuccessful"},"deprecated":false,"digest":{"function_hash":"221185430640167795994461514572675412671","length":665},"id":"ASB-A-193932765-5d058dd5","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/apex/+/85642155eecda9c895283e3050fdb376d92271ae","target":{"function":"RevertActiveSessions","file":"apexd/apexd.cpp"},"deprecated":false,"digest":{"length":1444,"function_hash":"125294212298402906571786902835556765207"},"id":"ASB-A-193932765-9a5b1882"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/apex/+/85642155eecda9c895283e3050fdb376d92271ae","target":{"function":"SnapshotOrRestoreDeIfNeeded","file":"apexd/apexd.cpp"},"deprecated":false,"digest":{"length":749,"function_hash":"65523335027097412076397067156421795660"},"id":"ASB-A-193932765-ace45464"},{"source":"https://android.googlesource.com/platform/system/apex/+/85642155eecda9c895283e3050fdb376d92271ae","target":{"file":"apexd/apexd.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["320368934161097258373103801471081216922","68058988134707673697915681617187371683","293871845438437000714851214961336583451","120069062108307707337704162973096265066","177323380561203205566506576379929417985","150129177591435773974734764521744983111","174566926346699008918903714615287313064","19822187885687733038830903977778256284","161386867502133588770722603680683819201","185637322169053659648262611643525432080","82734324360775399527833524396563565531","113462575722501739946523573326268959791","83610950489604769613188067601739555789","169803609558657796400748083876021886080","247501076125039994361520846362667370995","212712315670096086582947605449973107822"]},"id":"ASB-A-193932765-c1a8cc34","signature_type":"Line","signature_version":"v1"},{"target":{"file":"apexd/apexservice_test.cpp"},"deprecated":false,"digest":{"line_hashes":["71776072034085910789840484084957767367","223071834603685859378026100979384685739","21308573381988020948466282333566266874","278763187026425857757291849168933974831","242888823248232888448947889266252389506","37632723190152927075215054021761994635","66798092264571664492433124176993360","194168362368295224660763533037464496337","176816195945023825905190045703596969855","137458747424579871892187066689315327895","199120534089681793160055609323705101069","79838552734418631238722252323307207190"],"threshold":0.9},"id":"ASB-A-193932765-cd46adf5","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/apex/+/85642155eecda9c895283e3050fdb376d92271ae"},{"target":{"file":"apexd/apexservice_test.cpp","function":"TEST_F"},"deprecated":false,"digest":{"function_hash":"271649168231923886021933417791823138535","length":1111},"id":"ASB-A-193932765-d1cc1a26","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/apex/+/85642155eecda9c895283e3050fdb376d92271ae"}],"fixes":["https://android.googlesource.com/platform/system/apex/+/85642155eecda9c895283e3050fdb376d92271ae"],"severity":"High","spl":"2021-10-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-193932765.json"}},{"package":{"name":"platform/system/apex","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2021-10-01"}]}],"versions":["11"],"ecosystem_specific":{"severity":"High","spl":"2021-10-01","types":["ID"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/apex/+/f8365a8edcfd195562af485080d2a0462be8e180","target":{"file":"apexd/apexd.cpp","function":"revertActiveSessions"},"deprecated":false,"digest":{"function_hash":"146021214116064396526111273784920474487","length":1326},"id":"ASB-A-193932765-334b723b"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/apex/+/f8365a8edcfd195562af485080d2a0462be8e180","target":{"file":"apexd/apexservice_test.cpp","function":"TEST_F"},"deprecated":false,"digest":{"function_hash":"4225605585403834167859559494038422097","length":759},"id":"ASB-A-193932765-44acc72a","signature_type":"Function"},{"target":{"file":"apexd/apexservice_test.cpp","function":"TEST_F"},"deprecated":false,"digest":{"function_hash":"271649168231923886021933417791823138535","length":1111},"id":"ASB-A-193932765-5bf132d7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/apex/+/f8365a8edcfd195562af485080d2a0462be8e180"},{"id":"ASB-A-193932765-6cc57ff2","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/apex/+/f8365a8edcfd195562af485080d2a0462be8e180","target":{"file":"apexd/apexservice_test.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["71776072034085910789840484084957767367","223071834603685859378026100979384685739","21308573381988020948466282333566266874","278763187026425857757291849168933974831","242888823248232888448947889266252389506","37632723190152927075215054021761994635","66798092264571664492433124176993360","194168362368295224660763533037464496337","176816195945023825905190045703596969855","137458747424579871892187066689315327895","199120534089681793160055609323705101069","79838552734418631238722252323307207190"]}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/apex/+/f8365a8edcfd195562af485080d2a0462be8e180","target":{"file":"apexd/apexd.cpp","function":"markStagedSessionSuccessful"},"deprecated":false,"digest":{"function_hash":"221185430640167795994461514572675412671","length":665},"id":"ASB-A-193932765-788eb10f"},{"deprecated":false,"digest":{"function_hash":"230163486724358823151034931663723547050","length":740},"id":"ASB-A-193932765-a3356da4","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/apex/+/f8365a8edcfd195562af485080d2a0462be8e180","target":{"file":"apexd/apexd.cpp","function":"snapshotOrRestoreDeIfNeeded"}},{"target":{"file":"apexd/apexd.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["169296400959577218533387579562021010949","128834976284114198796887800814090678366","306046320310944667035266873422815445613","334119813775160906721629362649045046493","320368934161097258373103801471081216922","68058988134707673697915681617187371683","293871845438437000714851214961336583451","120069062108307707337704162973096265066","177323380561203205566506576379929417985","12257777062396164400265326842287906130","137502329816960007812806670706006202319","246290016886883701825675433257874847030","282556697257193086295839651627960455520","115048200509582525822702907663301154087","224476337885555874042652336701367178629","113462575722501739946523573326268959791","83610950489604769613188067601739555789","169803609558657796400748083876021886080","247501076125039994361520846362667370995","212712315670096086582947605449973107822"]},"id":"ASB-A-193932765-af566fcd","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/apex/+/f8365a8edcfd195562af485080d2a0462be8e180"}],"fixes":["https://android.googlesource.com/platform/system/apex/+/f8365a8edcfd195562af485080d2a0462be8e180"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-193932765.json"}},{"package":{"name":"platform/system/apex","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2021-10-01"}]}],"versions":["12"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-193932765-2b35a5b5","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/apex/+/85642155eecda9c895283e3050fdb376d92271ae","target":{"file":"apexd/apexservice_test.cpp"},"deprecated":false,"digest":{"line_hashes":["71776072034085910789840484084957767367","223071834603685859378026100979384685739","21308573381988020948466282333566266874","278763187026425857757291849168933974831","242888823248232888448947889266252389506","37632723190152927075215054021761994635","66798092264571664492433124176993360","194168362368295224660763533037464496337","176816195945023825905190045703596969855","137458747424579871892187066689315327895","199120534089681793160055609323705101069","79838552734418631238722252323307207190"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/system/apex/+/85642155eecda9c895283e3050fdb376d92271ae","target":{"file":"apexd/apexd.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["320368934161097258373103801471081216922","68058988134707673697915681617187371683","293871845438437000714851214961336583451","120069062108307707337704162973096265066","177323380561203205566506576379929417985","150129177591435773974734764521744983111","174566926346699008918903714615287313064","19822187885687733038830903977778256284","161386867502133588770722603680683819201","185637322169053659648262611643525432080","82734324360775399527833524396563565531","113462575722501739946523573326268959791","83610950489604769613188067601739555789","169803609558657796400748083876021886080","247501076125039994361520846362667370995","212712315670096086582947605449973107822"]},"id":"ASB-A-193932765-40d7adb1","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/apex/+/85642155eecda9c895283e3050fdb376d92271ae","target":{"function":"RevertActiveSessions","file":"apexd/apexd.cpp"},"deprecated":false,"digest":{"function_hash":"125294212298402906571786902835556765207","length":1444},"id":"ASB-A-193932765-749ddd16","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/system/apex/+/85642155eecda9c895283e3050fdb376d92271ae","target":{"function":"TEST_F","file":"apexd/apexservice_test.cpp"},"deprecated":false,"digest":{"function_hash":"4225605585403834167859559494038422097","length":759},"id":"ASB-A-193932765-8cb50f85","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/apex/+/85642155eecda9c895283e3050fdb376d92271ae","target":{"file":"apexd/apexd.cpp","function":"SnapshotOrRestoreDeIfNeeded"},"deprecated":false,"digest":{"function_hash":"65523335027097412076397067156421795660","length":749},"id":"ASB-A-193932765-bc67d8fe"},{"source":"https://android.googlesource.com/platform/system/apex/+/85642155eecda9c895283e3050fdb376d92271ae","target":{"file":"apexd/apexd.cpp","function":"MarkStagedSessionSuccessful"},"deprecated":false,"digest":{"function_hash":"221185430640167795994461514572675412671","length":665},"id":"ASB-A-193932765-dd5e55c4","signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/system/apex/+/85642155eecda9c895283e3050fdb376d92271ae","target":{"file":"apexd/apexservice_test.cpp","function":"TEST_F"},"deprecated":false,"digest":{"function_hash":"271649168231923886021933417791823138535","length":1111},"id":"ASB-A-193932765-f1d647c1","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/system/apex/+/85642155eecda9c895283e3050fdb376d92271ae"],"severity":"High","spl":"2021-10-01","types":["Unknown"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-193932765.json"}}],"schema_version":"1.9.0"}