{"id":"PUB-A-194694600","details":"In hci_send_acl and related functions of hci_core.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-194694600","CVE-2021-33034"],"modified":"2026-03-11T06:34:44.723660Z","published":"2022-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-06-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/5c4c8c9544099bb9043a10a5318130a943e32fc3"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2022-06-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"deprecated":false,"target":{"file":"net/bluetooth/hci_event.c"},"source":"https://android.googlesource.com/kernel/common/+/5c4c8c9544099bb9043a10a5318130a943e32fc3","signature_version":"v1","digest":{"line_hashes":["8079421475408174812840935138761870503","149028967828046616283649414939910617405","87517466533781006430034154401042079236","220217085820012978358288060334272580818","140485719149744892342272638687073716447","148249321736742285270402487365204002171","165703254341232650984361253764897162618","243938702843992248359438974254134963632"],"threshold":0.9},"id":"PUB-A-194694600-0e8c5222","signature_type":"Line"},{"deprecated":false,"target":{"file":"include/net/bluetooth/hci_core.h"},"source":"https://android.googlesource.com/kernel/common/+/5c4c8c9544099bb9043a10a5318130a943e32fc3","signature_version":"v1","digest":{"line_hashes":["75869243969825306294812844639812975829","57881833720794058667873042742744207397","171683051639382316481215321654958478197","326342439426828093251435173500487834938"],"threshold":0.9},"id":"PUB-A-194694600-110a969c","signature_type":"Line"},{"deprecated":false,"target":{"file":"net/bluetooth/hci_event.c","function":"hci_disconn_loglink_complete_evt"},"source":"https://android.googlesource.com/kernel/common/+/5c4c8c9544099bb9043a10a5318130a943e32fc3","signature_version":"v1","digest":{"length":429,"function_hash":"107372139021562613702413033798881309412"},"id":"PUB-A-194694600-67773e4d","signature_type":"Function"},{"deprecated":false,"target":{"file":"net/bluetooth/hci_event.c","function":"hci_loglink_complete_evt"},"source":"https://android.googlesource.com/kernel/common/+/5c4c8c9544099bb9043a10a5318130a943e32fc3","signature_version":"v1","digest":{"length":735,"function_hash":"292339631366349863096215495176622168356"},"id":"PUB-A-194694600-9e7911e6","signature_type":"Function"}],"spl":"2022-06-05","fixes":["https://android.googlesource.com/kernel/common/+/5c4c8c9544099bb9043a10a5318130a943e32fc3"],"severity":"Moderate"},"database_specific":{"source":"https://storage.googleapis.com/android-osv-test/PUB-A-194694600.json"}}],"schema_version":"1.7.5"}