{"id":"PUB-A-205573273","details":"In ion_buffer_kmap_get of ion.c, there is a possible use-after-free due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-205573273","CVE-2021-39714"],"modified":"2026-03-11T06:35:13.840015Z","published":"2022-08-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-08-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/721fb79e0eccd371a70054726dfe6931e6ed23e4"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/0d752f78b20dbe4eeb9bc76f118889f1898948ca"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/f48f8f7c3fdc21f34c45a7b3eeafb3109cf3340f"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/7f04e0c309811e762872a7ce71fba9cb359dd2c0"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/b6b3781a"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/618a931c"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2022-08-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/kernel/common/+/721fb79e0eccd371a70054726dfe6931e6ed23e4","https://android.googlesource.com/kernel/common/+/0d752f78b20dbe4eeb9bc76f118889f1898948ca","https://android.googlesource.com/kernel/common/+/f48f8f7c3fdc21f34c45a7b3eeafb3109cf3340f","https://android.googlesource.com/kernel/common/+/7f04e0c309811e762872a7ce71fba9cb359dd2c0","https://android.googlesource.com/kernel/common/+/b6b3781a","https://android.googlesource.com/kernel/common/+/618a931c"],"vanir_signatures":[{"digest":{"function_hash":"143589944968431461125676622989324634605","length":377},"id":"PUB-A-205573273-09e8f23e","signature_version":"v1","target":{"file":"drivers/staging/android/ion/ion_buffer.c","function":"ion_buffer_kmap_get"},"deprecated":false,"signature_type":"Function","source":"https://android.googlesource.com/kernel/common/+/7f04e0c309811e762872a7ce71fba9cb359dd2c0"},{"digest":{"function_hash":"4219159529549243608601486086579260767","length":410},"id":"PUB-A-205573273-1f2ed4d0","signature_version":"v1","target":{"file":"drivers/staging/android/ion/ion.c","function":"ion_buffer_kmap_get"},"deprecated":false,"signature_type":"Function","source":"https://android.googlesource.com/kernel/common/+/618a931c"},{"digest":{"function_hash":"4219159529549243608601486086579260767","length":410},"id":"PUB-A-205573273-2f0f89ff","signature_version":"v1","target":{"file":"drivers/staging/android/ion/ion.c","function":"ion_buffer_kmap_get"},"deprecated":false,"signature_type":"Function","source":"https://android.googlesource.com/kernel/common/+/b6b3781a"},{"digest":{"threshold":0.9,"line_hashes":["32066693641211963378462662023135189242","316971968143812374367631972781890494004","39606589143636630290617244170557724983","334251420500601506650157017286537155759"]},"id":"PUB-A-205573273-37e0126f","signature_version":"v1","target":{"file":"drivers/staging/android/ion/ion_buffer.c"},"deprecated":false,"signature_type":"Line","source":"https://android.googlesource.com/kernel/common/+/721fb79e0eccd371a70054726dfe6931e6ed23e4"},{"digest":{"function_hash":"143589944968431461125676622989324634605","length":377},"id":"PUB-A-205573273-43d66593","signature_version":"v1","target":{"file":"drivers/staging/android/ion/ion_buffer.c","function":"ion_buffer_kmap_get"},"deprecated":false,"signature_type":"Function","source":"https://android.googlesource.com/kernel/common/+/721fb79e0eccd371a70054726dfe6931e6ed23e4"},{"digest":{"threshold":0.9,"line_hashes":["32066693641211963378462662023135189242","316971968143812374367631972781890494004","39606589143636630290617244170557724983","334251420500601506650157017286537155759"]},"id":"PUB-A-205573273-557f96a3","signature_version":"v1","target":{"file":"drivers/staging/android/ion/ion_buffer.c"},"deprecated":false,"signature_type":"Line","source":"https://android.googlesource.com/kernel/common/+/7f04e0c309811e762872a7ce71fba9cb359dd2c0"},{"digest":{"threshold":0.9,"line_hashes":["65934957145507903299536105905483557201","316971968143812374367631972781890494004","39606589143636630290617244170557724983","334251420500601506650157017286537155759"]},"id":"PUB-A-205573273-869d9f05","signature_version":"v1","target":{"file":"drivers/staging/android/ion/ion.c"},"deprecated":false,"signature_type":"Line","source":"https://android.googlesource.com/kernel/common/+/618a931c"},{"digest":{"threshold":0.9,"line_hashes":["32066693641211963378462662023135189242","316971968143812374367631972781890494004","39606589143636630290617244170557724983","334251420500601506650157017286537155759"]},"id":"PUB-A-205573273-8d505e31","signature_version":"v1","target":{"file":"drivers/staging/android/ion/ion_buffer.c"},"deprecated":false,"signature_type":"Line","source":"https://android.googlesource.com/kernel/common/+/0d752f78b20dbe4eeb9bc76f118889f1898948ca"},{"digest":{"threshold":0.9,"line_hashes":["65934957145507903299536105905483557201","316971968143812374367631972781890494004","39606589143636630290617244170557724983","334251420500601506650157017286537155759"]},"id":"PUB-A-205573273-8e5aa7fd","signature_version":"v1","target":{"file":"drivers/staging/android/ion/ion.c"},"deprecated":false,"signature_type":"Line","source":"https://android.googlesource.com/kernel/common/+/b6b3781a"},{"digest":{"function_hash":"143589944968431461125676622989324634605","length":377},"id":"PUB-A-205573273-9298d123","signature_version":"v1","target":{"file":"drivers/staging/android/ion/ion_buffer.c","function":"ion_buffer_kmap_get"},"deprecated":false,"signature_type":"Function","source":"https://android.googlesource.com/kernel/common/+/0d752f78b20dbe4eeb9bc76f118889f1898948ca"},{"digest":{"threshold":0.9,"line_hashes":["32066693641211963378462662023135189242","316971968143812374367631972781890494004","39606589143636630290617244170557724983","334251420500601506650157017286537155759"]},"id":"PUB-A-205573273-a4efcae2","signature_version":"v1","target":{"file":"drivers/staging/android/ion/ion_buffer.c"},"deprecated":false,"signature_type":"Line","source":"https://android.googlesource.com/kernel/common/+/f48f8f7c3fdc21f34c45a7b3eeafb3109cf3340f"},{"digest":{"function_hash":"143589944968431461125676622989324634605","length":377},"id":"PUB-A-205573273-fdd0d6c6","signature_version":"v1","target":{"file":"drivers/staging/android/ion/ion_buffer.c","function":"ion_buffer_kmap_get"},"deprecated":false,"signature_type":"Function","source":"https://android.googlesource.com/kernel/common/+/f48f8f7c3fdc21f34c45a7b3eeafb3109cf3340f"}],"spl":"2022-08-05","severity":"Moderate"},"database_specific":{"source":"https://storage.googleapis.com/android-osv-test/PUB-A-205573273.json"}}],"schema_version":"1.7.5"}