Actively exploited in the wild
Android Kernel Race Condition Vulnerability
Android - Kernel · Listed in the CISA KEV since 2022-05-23. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-0920
MediumCVSS 6.4KEVSummary
In unix_scm_to_skb of af_unix.c, there is a possible use-after-free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed.
Risk Assessment
A local attacker could exploit this vulnerability to escalate privileges, potentially compromising the system. Exploitation does not require user interaction.
Recommendation
Update the Android kernel to a version containing the fix for this bug (Android ID: A-196926917).
Other vulnerabilities in Android kernel
See all- CVE-2017-13174High
CVE-2017-13174 is a privilege escalation vulnerability in the Android kernel. It affects Android kernel versions and may allow unauthorized access to system resources.
- CVE-2017-13168High
CVE-2017-13168 is a privilege escalation vulnerability in the Android kernel SCSI driver. It affects the Android kernel in versions related to Android ID A-65023233.
- CVE-2017-13167High
CVE-2017-13167 describes an elevation of privilege vulnerability in the kernel sound timer of Android. It affects the Android kernel in versions that do not include patches.
- CVE-2017-13164High
An information disclosure vulnerability in the kernel binder driver of Android. It affects the Android kernel and may lead to unauthorized access to sensitive data.
- CVE-2017-13163High
CVE-2017-13163 is a privilege escalation vulnerability in the MTP USB driver in the Android kernel. It affects Android kernel versions.
- CVE-2017-13162High
CVE-2017-13162 is a privilege escalation vulnerability in the Android kernel, which may allow unauthorized access to system resources.
- CVE-2017-0864High
CVE-2017-0864 is a privilege escalation vulnerability in the MediaTek ioctl (flashlight) in Android. It affects the Android kernel.
- CVE-2017-0862High
CVE-2017-0862 is a privilege escalation vulnerability in the Android kernel. It affects unspecified versions of the Android kernel.
- CVE-2017-0794High
CVE-2017-0794 is a privilege escalation vulnerability in the Upstream kernel SCSI driver. It affects the Android operating system and its kernel.
- CVE-2017-0750High
An elevation of privilege vulnerability in the Upstream Linux file system. It affects Android kernels.
Original NVD description (English source)
In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel