{"id":"PUB-A-168607263","details":"In ip6_xmit of ip6_output.c, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-168607263","CVE-2021-0935"],"modified":"2026-05-28T15:16:54.500952700Z","published":"2021-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2021-10-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/2f987a76a97773beafbc615b9c4d8fe79129a7f4"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/b954f94023dcc61388c8384f0f14eb8e42c863c5"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2021-10-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"vanir_signatures":[{"id":"PUB-A-168607263-32496ed4","digest":{"line_hashes":["25334347920569522898254242025624038336","234163967402709932542124777912514585765","287887375150421422070902850653839315346","307438346234822931023662687975222642135","42229323460979589077548826378825127077","220203633376058270147357934668866355459"],"threshold":0.9},"deprecated":false,"target":{"file":"net/l2tp/l2tp_core.h"},"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/b954f94023dcc61388c8384f0f14eb8e42c863c5","signature_type":"Line"},{"id":"PUB-A-168607263-4d4ba5f3","digest":{"length":1222,"function_hash":"277558364663445662139063537660023885451"},"deprecated":false,"target":{"file":"net/l2tp/l2tp_core.c","function":"l2tp_xmit_core"},"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/b954f94023dcc61388c8384f0f14eb8e42c863c5","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["30629078674881629507075756819812156032","290645555834032544297216613742360696443","332525058662962417552872165360775992143","130005574254180922053579103016478734896","298956824246871880746286545511068294466","134737045916994505465141234724924214030","109237579484837761712802639441019018252","199140676095963936663639144872808313891","113968269329523453572336784754258693694","195937048687659792578478194690921366441","264955549298918178805362998687553504720","203710946741074400395065047677231819394","246363828384079040570870416630862052497","211292513538822540770227675455853336668","220775383026815692482485608771079691346","211118441377423645131046640603276180323","10238047762864665048088382665974168808"],"threshold":0.9},"id":"PUB-A-168607263-96b0a4eb","target":{"file":"net/ipv6/datagram.c"},"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/2f987a76a97773beafbc615b9c4d8fe79129a7f4","signature_type":"Line"},{"id":"PUB-A-168607263-d478fe55","digest":{"line_hashes":["199805753334809386284240512017764486292","323297787826819263595689686456346211692","292624445830910953521017318505564285805","87816736335125847665056783845001028952","137556485212565658218546780433540473572","271616414432750161014771795714854805253","211990197813252145987022873279620318545","71831598799121006441233787108676186513","8176067402559171210308349273152146965","161883870379513453416109884586725860113","214451366990645929052225211280220976135","192914710129082849274294858012166361981","10087131679957325745346652867292524160","98477657405847844323148939807707345225","223944148276776784586217380532339177134","74172547960012552282123975037141029344","20518833492046021708765252229217275173","51421111569908637352408420806193255624","50213681984823527403630023363886087999","80913677579399052783671807507998446715","287373640473665033622544459376464751562","198781904341809177664854925488896028647","272025263074667212532466535156235330523","4251406668809995148891833693721132452","257854619223803227125315430149388733747","205819134824305476287386405979756165174","199203250900819989315682867461251079292","97743353004573830358496417400109528479","109780402459101146203937352085247859902","237407310431148557666477520853072572474","156872910084313152968311290634198524461","166791386586957100649197820374998959942"],"threshold":0.9},"deprecated":false,"target":{"file":"net/l2tp/l2tp_core.c"},"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/b954f94023dcc61388c8384f0f14eb8e42c863c5","signature_type":"Line"},{"id":"PUB-A-168607263-d6255408","digest":{"length":2310,"function_hash":"326151537545061741695079361850998252937"},"deprecated":false,"target":{"file":"net/ipv6/datagram.c","function":"__ip6_datagram_connect"},"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/2f987a76a97773beafbc615b9c4d8fe79129a7f4","signature_type":"Function"},{"id":"PUB-A-168607263-daca99b9","digest":{"length":3305,"function_hash":"283375205806437250461796966017913460870"},"deprecated":false,"source":"https://android.googlesource.com/kernel/common/+/b954f94023dcc61388c8384f0f14eb8e42c863c5","signature_version":"v1","target":{"file":"net/l2tp/l2tp_core.c","function":"l2tp_tunnel_create"},"signature_type":"Function"},{"id":"PUB-A-168607263-dd6e6da2","digest":{"length":1659,"function_hash":"314349946728839780801224023225017247234"},"deprecated":false,"target":{"file":"net/l2tp/l2tp_core.c","function":"l2tp_xmit_skb"},"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/b954f94023dcc61388c8384f0f14eb8e42c863c5","signature_type":"Function"}],"spl":"2021-10-05","types":["EoP"],"severity":"Moderate","fixes":["https://android.googlesource.com/kernel/common/+/2f987a76a97773beafbc615b9c4d8fe79129a7f4","https://android.googlesource.com/kernel/common/+/b954f94023dcc61388c8384f0f14eb8e42c863c5"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-168607263.json"}}],"schema_version":"1.7.5"}