{"id":"ASB-A-197228210","details":"In writeThrowable of AndroidFuture.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-197228210","CVE-2021-39676"],"modified":"2026-07-10T15:26:01.587957612Z","published":"2022-02-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-02-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2022-02-01"}]}],"versions":["11"],"ecosystem_specific":{"severity":"High","vanir_signatures":[{"signature_type":"Function","deprecated":false,"target":{"function":"logTrace","file":"core/java/com/android/internal/infra/ServiceConnector.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/562f1bd91f2845788ab907d687de6800ee49c6f8","signature_version":"v1","id":"ASB-A-197228210-0646805b","digest":{"length":150,"function_hash":"136826224916371556965637916355459646041"}},{"signature_type":"Function","deprecated":false,"target":{"function":"callListener","file":"core/java/com/android/internal/infra/AndroidFuture.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/562f1bd91f2845788ab907d687de6800ee49c6f8","signature_version":"v1","id":"ASB-A-197228210-081b8daf","digest":{"length":397,"function_hash":"67029985614114039650136161751978061065"}},{"signature_type":"Function","deprecated":false,"target":{"function":"parcelException","file":"core/java/com/android/internal/infra/AndroidFuture.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/562f1bd91f2845788ab907d687de6800ee49c6f8","signature_version":"v1","id":"ASB-A-197228210-1c493bc6","digest":{"length":356,"function_hash":"261054014243070610095270477776253849995"}},{"signature_type":"Function","deprecated":false,"id":"ASB-A-197228210-2019cfa4","source":"https://android.googlesource.com/platform/frameworks/base/+/562f1bd91f2845788ab907d687de6800ee49c6f8","signature_version":"v1","target":{"function":"unparcelException","file":"core/java/com/android/internal/infra/AndroidFuture.java"},"digest":{"length":542,"function_hash":"235401041891074141404768932583613147911"}},{"signature_type":"Function","deprecated":false,"id":"ASB-A-197228210-323c748d","source":"https://android.googlesource.com/platform/frameworks/base/+/562f1bd91f2845788ab907d687de6800ee49c6f8","signature_version":"v1","target":{"function":"unbind","file":"core/java/com/android/internal/infra/ServiceConnector.java"},"digest":{"length":163,"function_hash":"207136410368491064463065825749566677083"}},{"signature_type":"Function","deprecated":false,"id":"ASB-A-197228210-344552b7","source":"https://android.googlesource.com/platform/frameworks/base/+/562f1bd91f2845788ab907d687de6800ee49c6f8","signature_version":"v1","target":{"function":"scheduleUnbindTimeout","file":"core/java/com/android/internal/infra/ServiceConnector.java"},"digest":{"length":272,"function_hash":"71749410144110925786699964077440488730"}},{"signature_type":"Function","deprecated":false,"target":{"function":"cancelTimeout","file":"core/java/com/android/internal/infra/ServiceConnector.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/562f1bd91f2845788ab907d687de6800ee49c6f8","signature_version":"v1","id":"ASB-A-197228210-5d2aafcd","digest":{"length":113,"function_hash":"79192695768533100808106660331937527771"}},{"signature_type":"Function","deprecated":false,"id":"ASB-A-197228210-65f0fa3f","source":"https://android.googlesource.com/platform/frameworks/base/+/562f1bd91f2845788ab907d687de6800ee49c6f8","signature_version":"v1","target":{"function":"orTimeout","file":"core/java/com/android/internal/infra/AndroidFuture.java"},"digest":{"length":238,"function_hash":"86149553189589798767035139854720369177"}},{"signature_type":"Line","deprecated":false,"target":{"file":"core/java/com/android/internal/infra/AndroidFuture.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/562f1bd91f2845788ab907d687de6800ee49c6f8","signature_version":"v1","id":"ASB-A-197228210-90791e10","digest":{"threshold":0.9,"line_hashes":["229691760300476044552862832252368852501","197114409016051536079993570792396100821","257626584985631360811888143690077674983","258370877074811317734224501195292841139","182807735166669260289349174411582630785","170210847176624909180248416734586576668","312639980654604837683753723147694850052","292392069219354973053234857780798506636","258134136934939547424088358757129893093","110473425175742644854735812580914705169","333652702284174929477976099781994493262","5996077278307734467686532570368453303","136817069287192970486577689541721590557","51688177952321021285949057124368044407","157546641809603713737691308323796028610","158746829756532483196313538985149094888","295169366811352292023555127191953591754","278874112654579747175348767440982566599","15136439222600164237182860035293923793","276056670887203172690029718787741972824","191425081498922056632751092997968019167","322668937288341440731963618797186092741","211139481381551188489201319455336229799","175117687465480823196031139391141369242","317409493030260985322960937839405253142","9465409520275145739411129526821467240","5355454452829309742860357774613125525","82983721100000380353462140153714641241","167752471420029017134064347672301947853","322462886000767739780283610947168254287","179276036402919215671769914077653503047","329929866183296855458503655015463105800","37097014108123319308760620311024806381","338762598752699587784598052257780780239","331713905543855698875823935478358709803","196105335371994539056429215139722678430","327566942949159549012714020927273219312","310491586231695701730653717590220801512","102836164741346246513027943082344551083","72470634622915311477343065730849073817","306900014314011590507437882878063019145","143754368986268461472967603758383368519","337759777982916584376042514217296048581","222446930302788875018232112220885509326","306869886154246152843090515004605869555","177749343720746703741785257744528873334","205713296424814407587025255149044928844","207935119244835583697006329226975383979","327892639057860844825754215098734243386","94948574530774612140887823574030336154","208785672415875034614743446027800291588","61988405202406013303861875813352549335","156142450055854921788946124129659243438","229781742576510625244753970546942858837","236291856413005811547242203545212288428","10711873844004871466110045353349989386","138113089422435594025927238847468747026","163306178105630438534087259022346301393","140713396319052784215574429269527378571","304989469996888652348270304113208922565","167733026366059227369371591501900073696","91673778605229152153593706599010368206","6111493090180921942620345350623565080","237412117581472849071873231144922176216","270789168557893743768557441964003006714","13164723672111005864970643344107296024","16603570382138593047007308488377717851","77007663548454351037440971558450626236","292208355300799025348246717899105280722","95663088169693088501264762915065941349","753109723270690820676751494924687998","26351839503419596642884944865577904133","292633646286437573909975925489895777830","182143666912715830449359139307315145972","47533115038579853772879770932022549683","114077754140792114773021723642162231350","37641380298547646655226503739030180187","177301685225155352035369544661130744037","310630681300896136752671465247729225967","18647136782018758333881362641291340802","98605423346630352474389757520382322043","253183258682296583965503229846123311676","322343530051421401352714681561808032427","200626140550491710186811339737304845976","221314742013076580228593851445332800819","336858254663211459369693275022322719914"]}},{"signature_type":"Function","deprecated":false,"target":{"function":"callListenerAsync","file":"core/java/com/android/internal/infra/AndroidFuture.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/562f1bd91f2845788ab907d687de6800ee49c6f8","signature_version":"v1","id":"ASB-A-197228210-98f50167","digest":{"length":306,"function_hash":"99351455081287075726691242466137388307"}},{"signature_type":"Line","deprecated":false,"id":"ASB-A-197228210-b40cdbfe","source":"https://android.googlesource.com/platform/frameworks/base/+/562f1bd91f2845788ab907d687de6800ee49c6f8","signature_version":"v1","target":{"file":"core/java/com/android/internal/infra/ServiceConnector.java"},"digest":{"threshold":0.9,"line_hashes":["172995883641689222623925399399740495757","219078730979276832717862525096376174396","233625277913492766885091354335387656475","28007049339771353415541833890694076765","118807444847537464069070777830865359915","132046719946053377481515813800804715123","142856565546710159228515666104889667711","55389786375943144331300941088412295311","231118203631007251563846016728236680940","25619298406576272222235417658780838725","238653064360772590101663605609996294340","258739186693694283019139412398281135935","194315073675076138842432128411429418392","7741871062097274351086268505166449510","218925564333949307774525673957415399472","335193454047903767845148730000818810761","183906299250714354805945787478770143873","299780237537800878853724364775231459538","287081033499642799722405445103865691728","133793353634449865513412771404926718644","162083669533957502196077079949311429551","65537135401467469419575121828644561568","204516414945879832021346129322402810990","56093497900288346933005989289718734368","54639179825647789195638976373124494809","209229954266181894874733578160510510499","226052371651650715237351926612060278893","189733883890885239709423957949892933490","297372629436001453094498582580443968574","44725377506633032753191027362597716199","322787323643109560315432157839440080930","50432669689330268589633199023202623872","300048720999275752658042968087322502674","269057322104730266949062030115741608006","26724451383688621603939135070361661221","36079523023168185249552605189941225926","238545255094685180047174110858821702554","253588721856799589712078198379732780154","26238059765257497310645651463298094320","202352298827693977746602903529527386579","301888106459433712500608088382342321111","101587266739339776272751941177949901533","338942611259343801079002212269648821195","34048199077468473055689712842251484570","260583336250430583195098394791842714381","83152161908521603838260632320758153866","121908400663386725156711212544973138722","8064112100530985519956838756839575556","11735598997974577854110058978586317798","84031654470520180869157395431696848909"]}},{"signature_type":"Function","deprecated":false,"id":"ASB-A-197228210-bac72dc1","source":"https://android.googlesource.com/platform/frameworks/base/+/562f1bd91f2845788ab907d687de6800ee49c6f8","signature_version":"v1","target":{"function":"getJobHandler","file":"core/java/com/android/internal/infra/ServiceConnector.java"},"digest":{"length":52,"function_hash":"142870086757889321785522307375192629567"}},{"signature_type":"Function","deprecated":false,"target":{"function":"Impl","file":"core/java/com/android/internal/infra/ServiceConnector.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/562f1bd91f2845788ab907d687de6800ee49c6f8","signature_version":"v1","id":"ASB-A-197228210-f26932e9","digest":{"length":262,"function_hash":"54843815201846684483312071114267024358"}},{"signature_type":"Function","deprecated":false,"target":{"function":"enqueue","file":"core/java/com/android/internal/infra/ServiceConnector.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/562f1bd91f2845788ab907d687de6800ee49c6f8","signature_version":"v1","id":"ASB-A-197228210-f8128393","digest":{"length":183,"function_hash":"196777893431156718750973065773279023626"}}],"types":["EoP"],"spl":"2022-02-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/562f1bd91f2845788ab907d687de6800ee49c6f8"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-197228210.json"}}],"schema_version":"1.7.5"}