Actively exploited · Published Dec 15, 2021 · Assigned by google_android
CVE-2021-0920
Medium 6.4 Exploited
In plain English
A medium-severity use-after-free in Android. Attackers are actively exploiting it in the wild (listed by CISA on May 23, 2022). The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jun 13, 2022.
Official description
In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | kernel-tools-libs-devel | 4.18.0-348.20.1.el8_5 | ALSA-2022:0825 |
| Debian:12 | linux | 5.14.6-1 | DEBIAN-CVE-2021-0920 |
| Debian:13 | linux | 5.14.6-1 | DEBIAN-CVE-2021-0920 |
| Debian:14 | linux | 5.14.6-1 | DEBIAN-CVE-2021-0920 |
| Rocky Linux:8 | kernel | 0:4.18.0-348.20.1.el8_5 | RLSA-2022:0825 |
| Rocky Linux:8 | kernel-rt | 0:4.18.0-348.20.1.rt7.150.el8_5 | RLSA-2022:0819 |
| Ubuntu:22.04:LTS | linux-intel-iot-realtime | no fix listed | UBUNTU-CVE-2021-0920 |
| Ubuntu:24.04:LTS | linux-raspi-realtime | no fix listed | UBUNTU-CVE-2021-0920 |
| Ubuntu:22.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2021-0920 |
Affected products (as reported)
Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://source.android.com/security/bulletin/2021-11-01 x_refsource_MISC
- [debian-lts-announce] 20211216 [SECURITY] [DLA 2843-1] linux security update mailing-list, x_refsource_MLIST
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-0920 government-resource