CVE-2021-0920

Android Kernel: Race Condition

As of , CVE-2021-0920 in Android Kernel is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch soon.

Exploited
Yes: CISA listed it on 23 May 2022
US federal deadline
13 June 202221 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Not known to CISA
EPSS score
0.01Higher than 55% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
0.01 on 23 May 2022EPSS on the day CISA listed it.
Public exploit
None foundNeither Metasploit nor Exploit-DB lists one.
Fix
No vendor link in CISA's entry

What CISA says to do

Apply updates per vendor instructions.

CISA's required action

What the flaw is

Android kernel contains a race condition, which allows for a use-after-free vulnerability. Exploitation can allow for privilege escalation.

CISA's description

In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel

The CVE record's description, from google_android

CVE published
15 December 2021
Assigned by
google_android
CVSS
6.4 Medium (CVSS 3.1, from CISA-ADP)
CWE-416
Use After Free
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CISA SSVC, exploitation
active
CISA SSVC, automatable
no
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. CISA added it to its list of exploited vulnerabilities.
  3. The US federal deadline to fix it.

Kernel: other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2024-36971Remote Code ExecutionAndroid KernelPatch soon0.03
CVE-2021-1048Use-After-FreeAndroid KernelPatch soon0.01

Read further