CVE-2021-0920
CVE-2021-0920
In short
A race condition in Android's Unix socket implementation allows a local attacker to use memory that has already been freed, potentially gaining system-level privileges without needing to interact with the user.
Technical detail
CVE-2021-0920 is a use-after-free vulnerability (CWE-416) in unix_scm_to_skb() within af_unix.c, triggered by a race condition in concurrent socket operations. Local code execution can exploit this to achieve privilege escalation to system level; no user interaction required.
Summary generated and translated by AI from the official description.
In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · AndroidWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →