{"id":"PUB-A-173789633","details":"In acc_read of f_accessory.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-173789633","CVE-2021-0936"],"modified":"2026-04-23T15:15:38.048727Z","published":"2021-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2021-10-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/0e3db17d01c9"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/720da4ffe787"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/dbf07d723528"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/6be064d42c55"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/1edd54563125"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/1077960495b9"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/86c87779ede4"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/4df1d2ffe176"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/cd4f43077085"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/ff729a0610eb"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/429fec28c835"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/25670eded84f"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2021-10-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/kernel/common/+/1077960495b9","signature_type":"Function","target":{"function":"acc_disconnect","file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-01a39098","digest":{"length":52,"function_hash":"279573375294129927117975402795247661419"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/1edd54563125","signature_type":"Line","target":{"file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-036942c6","digest":{"line_hashes":["329176042677885532997597016490515164028","175416201952969528708604516036208093782","171230555072931899182265957580069056242","167972328886195659874335214974250126888","11521267093215324045342603276188646885","158838512720101526626234890442746082672","149537120580437362732553141059500123550","40814617619707303072047564723427521789"],"threshold":0.9},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/1077960495b9","signature_type":"Function","target":{"function":"acc_alloc","file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-061c95db","digest":{"length":577,"function_hash":"161602190224956284117109839124976043866"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/1077960495b9","signature_type":"Function","target":{"function":"kill_all_hid_devices","file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-11e04751","digest":{"length":609,"function_hash":"55051712581155407018128269515842731711"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/720da4ffe787","signature_type":"Line","target":{"file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-158f4afb","digest":{"line_hashes":["215672663632879508606623366912157068169","186478080489503428372413310554891772388","128859826572062116182779899698829062989"],"threshold":0.9},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/4df1d2ffe176","signature_type":"Line","target":{"file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-1b2154a5","digest":{"line_hashes":["108310348490818699135683826558460394405","79220267752915886126141714325427207010","153155817419365817600100548793949742139","251317940461538278480018655502638587918","292167515811365053051695278262338154475","281048598620739317140795494297455778675"],"threshold":0.9},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/6be064d42c55","signature_type":"Line","target":{"file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-2c02fede","digest":{"line_hashes":["225280387054771498040711883514299103539","338029648715251077337236046497805221014","231428083309234813312314676047858971596","239082514514332122697564833081155984674","333464466830375400101518805722046450000","220898788528219207629834577917677243618","99266217647415879143241271854407042404","54820754507410261895607310650434837850","176868186422294035190594138695550528846","278869243216320879839567996700964112915","288719446275705524243647104815623172371","52240541542814999086278516042044035544","102155258732891949040129174078201522932","164513056209429703672633092893548716571","85953201927160044302320775114963989657","124367776676533131628716551660317227300","239707360849959353696324427085543024763","227945880565333665273011189726399282413","175745266127218352081403176540825933327"],"threshold":0.9},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/86c87779ede4","signature_type":"Function","target":{"function":"get_acc_dev","file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-310ff590","digest":{"length":55,"function_hash":"214156672846589642432261441410823048507"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/429fec28c835","signature_type":"Line","target":{"file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-31fe0c7a","digest":{"line_hashes":["199277018618310017249489306658455136567","18836903526420782498384749681514613892","56778512481961073852773692375370850041","127269775524920307282639947715643341104","217292869288749869524074971462346278296"],"threshold":0.9},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/6be064d42c55","signature_type":"Function","target":{"function":"acc_alloc_inst","file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-3e7e6712","digest":{"length":513,"function_hash":"274548294608321144123139584427324593204"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/1077960495b9","signature_type":"Function","target":{"function":"acc_hid_work","file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-3eff660e","digest":{"length":1182,"function_hash":"34258552306332870327438217232589610117"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/720da4ffe787","signature_type":"Function","target":{"function":"acc_ctrlrequest","file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-4002df4a","digest":{"length":3051,"function_hash":"101226067179639114581684757169463940691"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/1077960495b9","signature_type":"Function","target":{"function":"acc_complete_out","file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-4672684f","digest":{"length":249,"function_hash":"5294480541145421460995016664931264088"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/86c87779ede4","signature_type":"Function","target":{"function":"acc_setup","file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-46ee423c","digest":{"length":705,"function_hash":"291541760956646495333208991088960723389"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/1077960495b9","signature_type":"Function","target":{"function":"acc_complete_in","file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-57c30b39","digest":{"length":274,"function_hash":"40890220871173376627781973415442057051"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/1077960495b9","signature_type":"Function","target":{"function":"acc_cleanup","file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-66f66ec3","digest":{"length":105,"function_hash":"172964226687015884769848006156827194982"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/6be064d42c55","signature_type":"Function","target":{"function":"acc_release","file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-723c60f4","digest":{"length":198,"function_hash":"221603667839994231401525193644784331007"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/1077960495b9","signature_type":"Function","target":{"function":"acc_release","file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-84df6256","digest":{"length":159,"function_hash":"121063076792556779298682600788297210471"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/1077960495b9","signature_type":"Line","target":{"file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-88f07e66","digest":{"line_hashes":["80973308283216350084901682413025290546","161123754182796235034257107647732732229","86141659631471755541859395915138283609","305127743595501064649366958755203497868","37442932356505892489203117604277769963","10402241341226332436636062893299295728","133348254535191320865660709450539154329","181089549712643786636121484127211293347","11625725501927820212408575520155436467","287078264794316135461181848871018288743","220262828000668887477953940981392439249","207368043647783632822057176425213756501","68198314446334396045280580472711326819","27966234336950527458165450659220203083","120853349636756857406725766720311012698","89627749151935867129649054380371626129","299596652205890407605559035363419822757","214040787817205036163519537903030775549","182609624531698009484398444092384341137","79120997930939005188756532989681908126","282013179047115175643439847914755114669","319395303225862310901078210461528289552","257029001298206106002152206635951271701","71077880261361771833728969679405921606","241945894057949935143895186444619702092","81259125415460467721123081923839550610","56709248024964498132480304372876847330","117108435526431240916474368244379226244","134441425976998112502935890134481439844","99340749787632912217123304782189744224","196330285106561607045016004459444751853","41871355835792255319292473503054479464","245977861112248608596196020223975494334","145525893212304874514063185511989208672","221182159638717473909042608575663564011","283021829530578018823808006695715945734","242328473478772804395432122581859339562","317683038112915875315939208308825290861","222339134022901475544928890108957854195","261773103525071760761224755306090026850","124341601484280613372131885371660096534","273834874948328061969506126259940324562","83690905670512582542783079671446145660","301830052659045526970721464685540989854","194615885144012838642701261512971191136","107176523982121969699138987819404359495","267421401863107236225866804505412785326","236674396378347081161531121596530352295","257665925652917890154894707895503242282","141002620887249307846770251611511811169","171316668514609509828619908859592745775","159309810256146607221929394448029561968","290260152617207878451141244833996362998","67275079680244802686277809070650302089","203742714421042195677622120831314152141","269658793582941248104386316956858109660","6417456291597090451887379760921534753","253106458328318007248093016295514698743","50471322316676896568142521210247804702","2347038799379029272494540942216398626","152047359806167457144050208559230291639","25536915549073483472926970924525006826","216400667982334006584775394315242381393","337111627251520984090274939691262964152","299071438506641552632877452077608174551","218570944242656746580714577418721198430","2680210074228976561182507903945137791","256756068135769066065373432690347942266","255221119662219709807504062470412908855","293269022782565890101603338416075517756","257026802285368485499015704851449944892","156324871213126383742402486725675284001","149832062111026508906297085708603660407","268012044311978950626978776008438339593","139615036458819262717243694511840829110"],"threshold":0.9},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/ff729a0610eb","signature_type":"Line","target":{"file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-8a43e475","digest":{"line_hashes":["201027383088299859670433299470330444866","94086078636034697017366320762187688095","295292840792122668350733543017841054724"],"threshold":0.9},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/ff729a0610eb","signature_type":"Function","target":{"function":"__put_acc_dev","file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-911f1dc8","digest":{"length":198,"function_hash":"81016612811925308106286135931010505640"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/86c87779ede4","signature_type":"Line","target":{"file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-929d5a8d","digest":{"line_hashes":["306559110968900426291308775095398483727","203132980914257132302134881987473346993","310830643122438752195149669627051148642","34351044059361103331203337142634128628","311533648554766309421481942752656471034","276585744605524618041943754245238764986","90020528557353257149201041878435646725","267654304422182773765043395974142476010","4919430911460173360479436791740065756","241670359760903220424520396030375137711","272818275174588323769655087757036510553","167403152045530133128033703877608347807","179841438393473926070423083560134747146","19263433213219346313064451755856223543","219074172486748041834057817328030897802","24615551318589620680107609096802310837","296884202403981221771769600527349246048","259543841281273942134108682499427369065","25219198395614784086023706586573394957","268344055729065849696654543659019735460","28151460759339288567240306177951893932","261766680795571747170221012937463986854","69118756463579661424894599415748278119","224752371854238271332539997354955835366","142448041894066843970882186500162066634","142176963944207303376938721928147568259","205750098245058738957834178283608438505","193139242793887258578789319287615414502","278339472661958510394658862645443364351","12315185500467096445888667780554218270","30813014460931759171884410993424020719","131282686113709134191957317080302848054","99391859293803735200091802921304808076","190609360190360073590403437486349894072","80391178793852306016505830800943326801"],"threshold":0.9},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/0e3db17d01c9","signature_type":"Function","target":{"function":"acc_read","file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-947e51d7","digest":{"length":1417,"function_hash":"142751328338696319295454209520228408255"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/6be064d42c55","signature_type":"Function","target":{"function":"acc_open","file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-9938cfb0","digest":{"length":237,"function_hash":"313164438804567980833356234042607791663"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/cd4f43077085","signature_type":"Line","target":{"file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-99f53f7d","digest":{"line_hashes":["99511659798888220427413191008775602921","78030160576134777173838191332541366391","92522794851270869947707763062363417956","231262410329632453773619299775833641623","185233960916934152042894300509694864887","131978156509354697434261904349361312561","254984408652555673390041710440684029131","220662784971745328608207086760791609207","211452470945239743430373514931085296098","83662502570095913021076849701162187584","214297902815083786796762446154275795394","245684067580538777689162184086731985262","144420834628611866634902259388042759390"],"threshold":0.9},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/1edd54563125","signature_type":"Function","target":{"function":"acc_alloc_inst","file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-a2e15727","digest":{"length":470,"function_hash":"244513687000800306875284609571499632961"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/6be064d42c55","signature_type":"Function","target":{"function":"acc_alloc","file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-aa6e93c0","digest":{"length":606,"function_hash":"11715419900891474083437334645968674708"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/25670eded84f","signature_type":"Function","target":{"function":"acc_disconnect","file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-b3ffff24","digest":{"length":106,"function_hash":"217972392428191533438348063416345450734"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/25670eded84f","signature_type":"Line","target":{"file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-b9d459a5","digest":{"line_hashes":["272765753433766838614642813003801021066","20601298892892226623329639156900440930","103846371464086363074748064683469646819","52724637744533510133221108826589173022","138194968154935274471023235123753226879"],"threshold":0.9},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/1077960495b9","signature_type":"Function","target":{"function":"acc_open","file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-bc4ba105","digest":{"length":201,"function_hash":"254831499654329404004550373258984259194"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/86c87779ede4","signature_type":"Function","target":{"function":"acc_cleanup","file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-beee4a7f","digest":{"length":144,"function_hash":"177034144749790760240925624870019203172"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/4df1d2ffe176","signature_type":"Function","target":{"function":"acc_release","file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-d8341f2b","digest":{"length":268,"function_hash":"160855479261727884438025847524474296333"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/cd4f43077085","signature_type":"Function","target":{"function":"acc_setup","file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-dc14199a","digest":{"length":790,"function_hash":"27635971431877382704795134745544286558"},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/0e3db17d01c9","signature_type":"Line","target":{"file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-dea738a8","digest":{"line_hashes":["140308446630451644528801151792931662834","114133813539291430447131308980696013209","252412203994580860281692131865015111733","299247135128080025173321024425301571465","85466051250627125533310295699359742959","53287002911792818201744421287550361918","158794573723165773490886874374483416292","298284233106041496378622858292499059917","239163834701112662141222423482763376154","56381590121950270574837864510528584802","145324204004733214215247582351705639456"],"threshold":0.9},"deprecated":false},{"source":"https://android.googlesource.com/kernel/common/+/1077960495b9","signature_type":"Function","target":{"function":"acc_ctrlrequest","file":"drivers/usb/gadget/function/f_accessory.c"},"signature_version":"v1","id":"PUB-A-173789633-e55537f6","digest":{"length":3082,"function_hash":"179062135972240512280212428250194372785"},"deprecated":false}],"fixes":["https://android.googlesource.com/kernel/common/+/0e3db17d01c9","https://android.googlesource.com/kernel/common/+/720da4ffe787","https://android.googlesource.com/kernel/common/+/dbf07d723528","https://android.googlesource.com/kernel/common/+/6be064d42c55","https://android.googlesource.com/kernel/common/+/1edd54563125","https://android.googlesource.com/kernel/common/+/1077960495b9","https://android.googlesource.com/kernel/common/+/86c87779ede4","https://android.googlesource.com/kernel/common/+/4df1d2ffe176","https://android.googlesource.com/kernel/common/+/cd4f43077085","https://android.googlesource.com/kernel/common/+/ff729a0610eb","https://android.googlesource.com/kernel/common/+/429fec28c835","https://android.googlesource.com/kernel/common/+/25670eded84f"],"severity":"Moderate","types":["EoP"],"spl":"2021-10-05"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-173789633.json"}}],"schema_version":"1.7.5"}