{"id":"PUB-A-205573273","details":"In ion_buffer_kmap_get of ion.c, there is a possible use-after-free due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-205573273","CVE-2021-39714"],"modified":"2026-04-13T15:04:09.269232Z","published":"2022-08-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-08-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/721fb79e0eccd371a70054726dfe6931e6ed23e4"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/0d752f78b20dbe4eeb9bc76f118889f1898948ca"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/f48f8f7c3fdc21f34c45a7b3eeafb3109cf3340f"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/7f04e0c309811e762872a7ce71fba9cb359dd2c0"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/b6b3781a"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/618a931c"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2022-08-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/721fb79e0eccd371a70054726dfe6931e6ed23e4","https://android.googlesource.com/kernel/common/+/0d752f78b20dbe4eeb9bc76f118889f1898948ca","https://android.googlesource.com/kernel/common/+/f48f8f7c3fdc21f34c45a7b3eeafb3109cf3340f","https://android.googlesource.com/kernel/common/+/7f04e0c309811e762872a7ce71fba9cb359dd2c0","https://android.googlesource.com/kernel/common/+/b6b3781a","https://android.googlesource.com/kernel/common/+/618a931c"],"spl":"2022-08-05","vanir_signatures":[{"digest":{"length":377,"function_hash":"143589944968431461125676622989324634605"},"target":{"file":"drivers/staging/android/ion/ion_buffer.c","function":"ion_buffer_kmap_get"},"signature_version":"v1","id":"PUB-A-205573273-09e8f23e","signature_type":"Function","source":"https://android.googlesource.com/kernel/common/+/7f04e0c309811e762872a7ce71fba9cb359dd2c0","deprecated":false},{"digest":{"length":410,"function_hash":"4219159529549243608601486086579260767"},"target":{"file":"drivers/staging/android/ion/ion.c","function":"ion_buffer_kmap_get"},"signature_version":"v1","id":"PUB-A-205573273-1f2ed4d0","signature_type":"Function","source":"https://android.googlesource.com/kernel/common/+/618a931c","deprecated":false},{"digest":{"length":410,"function_hash":"4219159529549243608601486086579260767"},"target":{"file":"drivers/staging/android/ion/ion.c","function":"ion_buffer_kmap_get"},"signature_version":"v1","id":"PUB-A-205573273-2f0f89ff","signature_type":"Function","source":"https://android.googlesource.com/kernel/common/+/b6b3781a","deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["32066693641211963378462662023135189242","316971968143812374367631972781890494004","39606589143636630290617244170557724983","334251420500601506650157017286537155759"]},"target":{"file":"drivers/staging/android/ion/ion_buffer.c"},"signature_version":"v1","id":"PUB-A-205573273-37e0126f","signature_type":"Line","source":"https://android.googlesource.com/kernel/common/+/721fb79e0eccd371a70054726dfe6931e6ed23e4","deprecated":false},{"digest":{"length":377,"function_hash":"143589944968431461125676622989324634605"},"target":{"file":"drivers/staging/android/ion/ion_buffer.c","function":"ion_buffer_kmap_get"},"signature_version":"v1","id":"PUB-A-205573273-43d66593","signature_type":"Function","source":"https://android.googlesource.com/kernel/common/+/721fb79e0eccd371a70054726dfe6931e6ed23e4","deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["32066693641211963378462662023135189242","316971968143812374367631972781890494004","39606589143636630290617244170557724983","334251420500601506650157017286537155759"]},"target":{"file":"drivers/staging/android/ion/ion_buffer.c"},"signature_version":"v1","id":"PUB-A-205573273-557f96a3","signature_type":"Line","source":"https://android.googlesource.com/kernel/common/+/7f04e0c309811e762872a7ce71fba9cb359dd2c0","deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["65934957145507903299536105905483557201","316971968143812374367631972781890494004","39606589143636630290617244170557724983","334251420500601506650157017286537155759"]},"target":{"file":"drivers/staging/android/ion/ion.c"},"signature_version":"v1","id":"PUB-A-205573273-869d9f05","signature_type":"Line","source":"https://android.googlesource.com/kernel/common/+/618a931c","deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["32066693641211963378462662023135189242","316971968143812374367631972781890494004","39606589143636630290617244170557724983","334251420500601506650157017286537155759"]},"target":{"file":"drivers/staging/android/ion/ion_buffer.c"},"signature_version":"v1","id":"PUB-A-205573273-8d505e31","signature_type":"Line","source":"https://android.googlesource.com/kernel/common/+/0d752f78b20dbe4eeb9bc76f118889f1898948ca","deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["65934957145507903299536105905483557201","316971968143812374367631972781890494004","39606589143636630290617244170557724983","334251420500601506650157017286537155759"]},"target":{"file":"drivers/staging/android/ion/ion.c"},"signature_version":"v1","id":"PUB-A-205573273-8e5aa7fd","signature_type":"Line","source":"https://android.googlesource.com/kernel/common/+/b6b3781a","deprecated":false},{"digest":{"length":377,"function_hash":"143589944968431461125676622989324634605"},"target":{"file":"drivers/staging/android/ion/ion_buffer.c","function":"ion_buffer_kmap_get"},"signature_version":"v1","id":"PUB-A-205573273-9298d123","signature_type":"Function","source":"https://android.googlesource.com/kernel/common/+/0d752f78b20dbe4eeb9bc76f118889f1898948ca","deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["32066693641211963378462662023135189242","316971968143812374367631972781890494004","39606589143636630290617244170557724983","334251420500601506650157017286537155759"]},"target":{"file":"drivers/staging/android/ion/ion_buffer.c"},"signature_version":"v1","id":"PUB-A-205573273-a4efcae2","signature_type":"Line","source":"https://android.googlesource.com/kernel/common/+/f48f8f7c3fdc21f34c45a7b3eeafb3109cf3340f","deprecated":false},{"digest":{"length":377,"function_hash":"143589944968431461125676622989324634605"},"target":{"file":"drivers/staging/android/ion/ion_buffer.c","function":"ion_buffer_kmap_get"},"signature_version":"v1","id":"PUB-A-205573273-fdd0d6c6","signature_type":"Function","source":"https://android.googlesource.com/kernel/common/+/f48f8f7c3fdc21f34c45a7b3eeafb3109cf3340f","deprecated":false}],"types":["EoP"],"severity":"Moderate"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-205573273.json"}}],"schema_version":"1.7.5"}