{"id":"PUB-A-189857506","details":"In adjustStreamVolume of AudioService.java, there is a possible way for unprivileged app to change audio stream volume due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-189857506","CVE-2021-1003"],"modified":"2026-09-22T15:22:15.314525410Z","published":"2021-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2021-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/c9faa86b663fb10b9ce18c6eea289998149cf0c0"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2021-12-01"}]}],"versions":["12"],"ecosystem_specific":{"severity":"Moderate","spl":"2021-12-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c9faa86b663fb10b9ce18c6eea289998149cf0c0","target":{"file":"services/core/java/com/android/server/audio/AudioService.java","function":"adjustStreamVolume"},"deprecated":false,"digest":{"function_hash":"229848090531403255350500580011062689665","length":6339},"id":"PUB-A-189857506-0f538fe2"},{"id":"PUB-A-189857506-240e3f8a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c9faa86b663fb10b9ce18c6eea289998149cf0c0","target":{"file":"services/core/java/com/android/server/audio/AudioService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["332362075002006840897757997245010866707","88082765006021291666888350319933755774","199559284023706165518137502042054505008","90154078779153854148620090741030634285","126053827948530347341558679711716707237","42767107984832930824818514575578349429","219440317300316743129838900386527633146","11969624549169480633927928133606775610","308674857913491941294276578270831145716","126450315647496440637948292216009133276","138565737944649647512821514033202615732","24315592866018561649723953844644330967","77663408281455585376553007756698517939","14343462893436032871895586011308808150","241324826696876876339676478944749986651","101717656812738912142182850649331197077","319966085109076849680731993465850469979","132662135110751475822400368632496079776","238152992693324425743036416288134984628","42463004679312660123824356974060720437","8104401553142081672750269746136222453","91117865676088235855574476063404218275","132922240310170478791126224048983951396","20856376483848617411247307598865713114","93511588156391327931479686367141943152","67894012001458453909386808502229819887","147256450851834887934737346438865239192","35592830087115305739366227496025768392","49638155813903634337020172292728756989","317005341899037308515412622661197791252","197937830616888864475559076122288477303","168156399722380337753077197849008843666","294333484281651030810474221999890669509","218134608201755984609687724827160926786","205938998962971219817995278560824944411","321377727421727357143730807448957821928","161177477784511431711404166798943341326","229771964068623829059998861548202120966","279542479549421191501632307529893924539","241934386894827836045494252892510183978","122284699672394430142863166922896920784","92673348262987812938086090881907651014","297819141294355528872287388576162190532","186163298514300650201337997668552029014","331328728009187834648162835649615647197","233087883125967974270771284512817741321","92341361636867175553812595874940575669","266624202651930434872385226453218413722","246801477229179962522915252312642983331","112449888928072689587830050480626766354","233679544100170840036934792498647286082","320096886887088222825922823394601191883","39962651337797097537802345954541494526","240394432125817665752417755974377559440","40386732100480392911824027534493013411","227957856929691944819273301655496617561","103822586129186314409938061060974985708","159059838838296018801638194923648731250","224940666976303425779436616753859532574","45074599075530992578011976702618018697","231162589126157599903013945777320249227","90885880044233636648683220217826240215","249296623165595434365832763580211233200","99554295212475878118269820727189668199","24713188362614321042392090737163534463","186578291297025661422945901990096111771","18602179836295546830523506580337805732","199630816398670776073663619348805198444"]}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c9faa86b663fb10b9ce18c6eea289998149cf0c0","target":{"file":"services/core/java/com/android/server/audio/AudioService.java","function":"adjustStreamVolumeForUid"},"deprecated":false,"digest":{"length":611,"function_hash":"306104976228154245936995209127879964521"},"id":"PUB-A-189857506-4bd43c9c"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c9faa86b663fb10b9ce18c6eea289998149cf0c0","target":{"function":"adjustStreamVolume","file":"services/core/java/com/android/server/audio/AudioService.java"},"deprecated":false,"digest":{"length":528,"function_hash":"335451753750024340878238816519409009617"},"id":"PUB-A-189857506-5474b8e4","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c9faa86b663fb10b9ce18c6eea289998149cf0c0","target":{"file":"services/core/java/com/android/server/audio/AudioService.java","function":"handleVolumeKey"},"deprecated":false,"digest":{"function_hash":"305532215895826902323581106852730332412","length":1249},"id":"PUB-A-189857506-59ed676e"},{"digest":{"function_hash":"69529015852470117364888860733400577429","length":2291},"id":"PUB-A-189857506-6e1714bf","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c9faa86b663fb10b9ce18c6eea289998149cf0c0","target":{"file":"services/core/java/com/android/server/audio/AudioService.java","function":"adjustSuggestedStreamVolume"},"deprecated":false},{"id":"PUB-A-189857506-870d58f8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c9faa86b663fb10b9ce18c6eea289998149cf0c0","target":{"file":"services/core/java/com/android/server/audio/AudioService.java","function":"setMasterMute"},"deprecated":false,"digest":{"function_hash":"230252471010001077338827952021509763966","length":160}},{"digest":{"length":202,"function_hash":"312001254852820113303003776544450203787"},"id":"PUB-A-189857506-bd5def90","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c9faa86b663fb10b9ce18c6eea289998149cf0c0","target":{"function":"adjustSuggestedStreamVolume","file":"services/core/java/com/android/server/audio/AudioService.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"176033949189679480908963484611784925332","length":542},"id":"PUB-A-189857506-e85e6abf","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c9faa86b663fb10b9ce18c6eea289998149cf0c0","target":{"function":"setMasterMuteInternal","file":"services/core/java/com/android/server/audio/AudioService.java"}},{"id":"PUB-A-189857506-f4b3dbf4","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c9faa86b663fb10b9ce18c6eea289998149cf0c0","target":{"file":"services/core/java/com/android/server/audio/AudioService.java","function":"adjustSuggestedStreamVolumeForUid"},"deprecated":false,"digest":{"function_hash":"56829144019611800099955451913445726749","length":378}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c9faa86b663fb10b9ce18c6eea289998149cf0c0"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-189857506.json"}}],"schema_version":"1.9.0"}