CVE-2021-1029: Use After Free
In setClientStateLocked of SurfaceFlinger.cpp, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/nativeto a version that resolves this vulnerability.Fixed in 12:2021-12-01
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Android 12 devices using the affected SurfaceFlinger code are in scope. Exploitation is local rather than network-based.
What access does an attacker need to exploit it?
An attacker needs local access and low-level privileges. No user interaction or additional execution privileges are required.
What is the likely impact if exploitation succeeds?
Successful exploitation could allow local escalation of privilege. The reported impact includes high confidentiality, integrity, and availability effects.
Which component should be checked for remediation?
The issue is in SurfaceFlinger.cpp, within android/platform/frameworks/native, specifically setClientStateLocked. Review Android security updates associated with Android ID A-193034677.