{"id":"ASB-A-461507723","details":"In modpowF4 of avb_rsa.c, there is a possible signature verification bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-461507723","CVE-2026-58956"],"modified":"2026-11-02T17:11:17.703564738Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/external/avb","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["295888276594966255304195588615565650312","43919443325846488345856449299617816396","47918743755306585630071247991389662160","90320165058021931767383223621283132405","25652301680987172828517213841730144170","186167342490246128988331065328875165621","145079804260352517559297267693476946183","270958262497982618998214295548258911279","222739456146484954029573998889475780352","334951624658366945285492077903980358926","37001477771028326292229767023349440890","340193210849633232090684683998124351142","80084644866510519480419027006621445508","102459536319354513070929098183781529195","289794736789759278524507271740860914604","57237917623675569214869953447193572993","221621757692718643360303840497824853455","179527262868024871688976240454254376896"]},"id":"ASB-A-461507723-005b0c6c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/avb/+/5262c8ef81ae5d4606da24d004bd3170308f9dcf","target":{"file":"libavb/avb_rsa.c"}},{"source":"https://android.googlesource.com/platform/external/avb/+/5262c8ef81ae5d4606da24d004bd3170308f9dcf","target":{"file":"libavb/avb_rsa.c","function":"modpowF4"},"deprecated":false,"digest":{"function_hash":"99121567533606075055862966666024805091","length":1360},"id":"ASB-A-461507723-9d51b375","signature_type":"Function","signature_version":"v1"},{"id":"ASB-A-461507723-b077173e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/avb/+/5262c8ef81ae5d4606da24d004bd3170308f9dcf","target":{"file":"libavb/avb_rsa.c","function":"avb_rsa_verify"},"deprecated":false,"digest":{"function_hash":"69548868784106392191353185226868731472","length":1531}}],"fixes":["https://android.googlesource.com/platform/external/avb/+/5262c8ef81ae5d4606da24d004bd3170308f9dcf"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-461507723.json"}},{"package":{"name":"platform/external/avb","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/avb/+/e85551ac83e561a8ee0a14408acf8928f2afea7d"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"digest":{"length":1197,"function_hash":"59930707550007530595320650224867079192"},"id":"ASB-A-461507723-1636f1e7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/avb/+/e85551ac83e561a8ee0a14408acf8928f2afea7d","target":{"file":"libavb/avb_rsa.c","function":"avb_rsa_verify"},"deprecated":false},{"digest":{"function_hash":"99121567533606075055862966666024805091","length":1360},"id":"ASB-A-461507723-c06135e8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/avb/+/e85551ac83e561a8ee0a14408acf8928f2afea7d","target":{"file":"libavb/avb_rsa.c","function":"modpowF4"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["295888276594966255304195588615565650312","43919443325846488345856449299617816396","47918743755306585630071247991389662160","90320165058021931767383223621283132405","25652301680987172828517213841730144170","186167342490246128988331065328875165621","145079804260352517559297267693476946183","270958262497982618998214295548258911279","222739456146484954029573998889475780352","334951624658366945285492077903980358926","37001477771028326292229767023349440890","340193210849633232090684683998124351142","237040744458659864527797877325660687507","253166598775633115102591107008784942957","289794736789759278524507271740860914604","57237917623675569214869953447193572993","221621757692718643360303840497824853455","179527262868024871688976240454254376896"],"threshold":0.9},"id":"ASB-A-461507723-eb0e7707","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/avb/+/e85551ac83e561a8ee0a14408acf8928f2afea7d","target":{"file":"libavb/avb_rsa.c"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-461507723.json"}},{"package":{"name":"platform/external/avb","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"59930707550007530595320650224867079192","length":1197},"id":"ASB-A-461507723-95c44735","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/avb/+/09ae0f478a10d492a91f9355b47e57460d36bf88","target":{"function":"avb_rsa_verify","file":"libavb/avb_rsa.c"}},{"source":"https://android.googlesource.com/platform/external/avb/+/09ae0f478a10d492a91f9355b47e57460d36bf88","target":{"file":"libavb/avb_rsa.c","function":"modpowF4"},"deprecated":false,"digest":{"function_hash":"99121567533606075055862966666024805091","length":1360},"id":"ASB-A-461507723-b0086948","signature_type":"Function","signature_version":"v1"},{"target":{"file":"libavb/avb_rsa.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["295888276594966255304195588615565650312","43919443325846488345856449299617816396","47918743755306585630071247991389662160","90320165058021931767383223621283132405","25652301680987172828517213841730144170","186167342490246128988331065328875165621","145079804260352517559297267693476946183","270958262497982618998214295548258911279","222739456146484954029573998889475780352","334951624658366945285492077903980358926","37001477771028326292229767023349440890","340193210849633232090684683998124351142","237040744458659864527797877325660687507","253166598775633115102591107008784942957","289794736789759278524507271740860914604","57237917623675569214869953447193572993","221621757692718643360303840497824853455","179527262868024871688976240454254376896"]},"id":"ASB-A-461507723-ec514cf7","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/avb/+/09ae0f478a10d492a91f9355b47e57460d36bf88"}],"fixes":["https://android.googlesource.com/platform/external/avb/+/09ae0f478a10d492a91f9355b47e57460d36bf88"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-461507723.json"}},{"package":{"name":"platform/external/avb","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/avb/+/d2f20a12eabce52ebef18ed02ca44c4ac97a6a4c","target":{"file":"libavb/avb_rsa.c","function":"avb_rsa_verify"},"deprecated":false,"digest":{"function_hash":"69548868784106392191353185226868731472","length":1531},"id":"ASB-A-461507723-60e3e5f8","signature_type":"Function"},{"target":{"file":"libavb/avb_rsa.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["295888276594966255304195588615565650312","43919443325846488345856449299617816396","47918743755306585630071247991389662160","90320165058021931767383223621283132405","25652301680987172828517213841730144170","186167342490246128988331065328875165621","145079804260352517559297267693476946183","270958262497982618998214295548258911279","222739456146484954029573998889475780352","334951624658366945285492077903980358926","37001477771028326292229767023349440890","340193210849633232090684683998124351142","80084644866510519480419027006621445508","102459536319354513070929098183781529195","289794736789759278524507271740860914604","57237917623675569214869953447193572993","221621757692718643360303840497824853455","179527262868024871688976240454254376896"]},"id":"ASB-A-461507723-7b487072","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/avb/+/d2f20a12eabce52ebef18ed02ca44c4ac97a6a4c"},{"deprecated":false,"digest":{"function_hash":"99121567533606075055862966666024805091","length":1360},"id":"ASB-A-461507723-af506b73","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/avb/+/d2f20a12eabce52ebef18ed02ca44c4ac97a6a4c","target":{"file":"libavb/avb_rsa.c","function":"modpowF4"}}],"fixes":["https://android.googlesource.com/platform/external/avb/+/d2f20a12eabce52ebef18ed02ca44c4ac97a6a4c"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-461507723.json"}},{"package":{"name":"platform/external/avb","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["295888276594966255304195588615565650312","43919443325846488345856449299617816396","47918743755306585630071247991389662160","90320165058021931767383223621283132405","25652301680987172828517213841730144170","186167342490246128988331065328875165621","145079804260352517559297267693476946183","270958262497982618998214295548258911279","222739456146484954029573998889475780352","334951624658366945285492077903980358926","37001477771028326292229767023349440890","340193210849633232090684683998124351142","80084644866510519480419027006621445508","102459536319354513070929098183781529195","289794736789759278524507271740860914604","57237917623675569214869953447193572993","221621757692718643360303840497824853455","179527262868024871688976240454254376896"],"threshold":0.9},"id":"ASB-A-461507723-1e309872","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/avb/+/88d897a6a52b484d190bd6bb6b01d9d8678b3b11","target":{"file":"libavb/avb_rsa.c"}},{"target":{"function":"modpowF4","file":"libavb/avb_rsa.c"},"deprecated":false,"digest":{"length":1360,"function_hash":"99121567533606075055862966666024805091"},"id":"ASB-A-461507723-b5b03191","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/avb/+/88d897a6a52b484d190bd6bb6b01d9d8678b3b11"},{"target":{"function":"avb_rsa_verify","file":"libavb/avb_rsa.c"},"deprecated":false,"digest":{"function_hash":"69548868784106392191353185226868731472","length":1531},"id":"ASB-A-461507723-c85f16a6","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/avb/+/88d897a6a52b484d190bd6bb6b01d9d8678b3b11"}],"fixes":["https://android.googlesource.com/platform/external/avb/+/88d897a6a52b484d190bd6bb6b01d9d8678b3b11"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-461507723.json"}},{"package":{"name":"platform/external/avb","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"id":"ASB-A-461507723-38159e5a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/avb/+/e8819556a9d3da7cb46005e9bbed970da4777455","target":{"file":"libavb/avb_rsa.c"},"deprecated":false,"digest":{"line_hashes":["295888276594966255304195588615565650312","43919443325846488345856449299617816396","47918743755306585630071247991389662160","90320165058021931767383223621283132405","25652301680987172828517213841730144170","186167342490246128988331065328875165621","145079804260352517559297267693476946183","270958262497982618998214295548258911279","222739456146484954029573998889475780352","334951624658366945285492077903980358926","37001477771028326292229767023349440890","340193210849633232090684683998124351142","237040744458659864527797877325660687507","253166598775633115102591107008784942957","289794736789759278524507271740860914604","57237917623675569214869953447193572993","221621757692718643360303840497824853455","179527262868024871688976240454254376896"],"threshold":0.9}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/avb/+/e8819556a9d3da7cb46005e9bbed970da4777455","target":{"file":"libavb/avb_rsa.c","function":"avb_rsa_verify"},"deprecated":false,"digest":{"length":1197,"function_hash":"59930707550007530595320650224867079192"},"id":"ASB-A-461507723-8e70628d","signature_type":"Function"},{"target":{"function":"modpowF4","file":"libavb/avb_rsa.c"},"deprecated":false,"digest":{"function_hash":"99121567533606075055862966666024805091","length":1360},"id":"ASB-A-461507723-f47218d7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/avb/+/e8819556a9d3da7cb46005e9bbed970da4777455"}],"fixes":["https://android.googlesource.com/platform/external/avb/+/e8819556a9d3da7cb46005e9bbed970da4777455"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-461507723.json"}}],"schema_version":"1.9.2"}