Skip to content
OpenAdvisories
Unscored CVE-2021-39714 EUVD-2021-26071GHSA-v9hh-2rrq-p479

In ion_buffer_kmap_get of ion.c, there is a possible use-after-free due to an integer overflow. This could lead to local escalation of priv…

Published Mar 16, 2022 · Updated Aug 4, 2024 · Assigned by google_android

Package: linux Package: linux Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-edge Package: linux-fips Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gke-4.15 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.8 Package: linux-hwe-edge Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-kvm Package: linux-lts-xenial Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.6 Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.8 Package: linux-snapdragon Package: linux-vmware Platform: Android Ecosystem: Debian Ecosystem: Ubuntu

Description

In ion_buffer_kmap_get of ion.c, there is a possible use-after-free due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-205573273References: Upstream kernel

Affected products

VendorProductAffectedFixed
— Android Android kernel —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 linux 4.12.6-1 —
Debian 13 linux 4.12.6-1 —
Debian 12 linux 4.12.6-1 —
Debian 9 linux 4.9.303-1 DLA-2940-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS linux-raspi-realtime No fix yet —
Ubuntu 22.04 LTS linux-realtime +1 No fix yet —
Ubuntu 20.04 LTS linux-riscv +17 No fix yet —
Ubuntu 18.04 LTS linux-gcp +11 No fix yet —
Ubuntu 18.04 LTS linux-snapdragon 4.15.0-1053.57 —
Ubuntu 16.04 LTS linux-azure 4.13.0-1005.7 —
Ubuntu 16.04 LTS linux-gcp 4.13.0-1002.5 —
Ubuntu 16.04 LTS linux-hwe 4.13.0-32.35~16.04.1 —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro FIPS 16.04 LTS linux-fips No fix yet —
Ubuntu Pro FIPS-updates 16.04 LTS linux-fips 4.4.0-1079.86 —
Ubuntu Pro 16.04 LTS linux 4.4.0-229.263 —
Ubuntu Pro 16.04 LTS linux-aws 4.4.0-1145.160 —
Ubuntu Pro 16.04 LTS linux-kvm 4.4.0-1110.120 USN-5505-1
Ubuntu Pro 14.04 LTS linux-aws 4.4.0-1109.115 USN-5513-1
Ubuntu Pro 14.04 LTS linux-lts-xenial 4.4.0-229.263~14.04.1 USN-5505-1

Advisories 5

References