{"id":"PUB-A-194694600","details":"In hci_send_acl and related functions of hci_core.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-194694600","CVE-2021-33034"],"modified":"2026-04-13T15:04:09.269232Z","published":"2022-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-06-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/5c4c8c9544099bb9043a10a5318130a943e32fc3"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2022-06-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/kernel/common/+/5c4c8c9544099bb9043a10a5318130a943e32fc3"],"severity":"Moderate","vanir_signatures":[{"source":"https://android.googlesource.com/kernel/common/+/5c4c8c9544099bb9043a10a5318130a943e32fc3","signature_type":"Line","target":{"file":"net/bluetooth/hci_event.c"},"signature_version":"v1","deprecated":false,"digest":{"line_hashes":["8079421475408174812840935138761870503","149028967828046616283649414939910617405","87517466533781006430034154401042079236","220217085820012978358288060334272580818","140485719149744892342272638687073716447","148249321736742285270402487365204002171","165703254341232650984361253764897162618","243938702843992248359438974254134963632"],"threshold":0.9},"id":"PUB-A-194694600-0e8c5222"},{"source":"https://android.googlesource.com/kernel/common/+/5c4c8c9544099bb9043a10a5318130a943e32fc3","signature_type":"Line","target":{"file":"include/net/bluetooth/hci_core.h"},"signature_version":"v1","deprecated":true,"digest":{"line_hashes":["75869243969825306294812844639812975829","57881833720794058667873042742744207397","171683051639382316481215321654958478197","326342439426828093251435173500487834938"],"threshold":0.9},"id":"PUB-A-194694600-110a969c"},{"source":"https://android.googlesource.com/kernel/common/+/5c4c8c9544099bb9043a10a5318130a943e32fc3","signature_type":"Function","target":{"function":"hci_disconn_loglink_complete_evt","file":"net/bluetooth/hci_event.c"},"signature_version":"v1","deprecated":false,"digest":{"function_hash":"107372139021562613702413033798881309412","length":429},"id":"PUB-A-194694600-67773e4d"},{"source":"https://android.googlesource.com/kernel/common/+/5c4c8c9544099bb9043a10a5318130a943e32fc3","signature_type":"Function","target":{"function":"hci_loglink_complete_evt","file":"net/bluetooth/hci_event.c"},"signature_version":"v1","deprecated":false,"digest":{"function_hash":"292339631366349863096215495176622168356","length":735},"id":"PUB-A-194694600-9e7911e6"}],"spl":"2022-06-05"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-194694600.json"}}],"schema_version":"1.7.5"}