CVE-2021-0697: Android PVRSRVRGXSubmitTransferKM User After Free Vulnerability
Summary
CVE-2021-0697: In PVRSRVRGXSubmitTransferKM of rgxtransfer.c, there is a possible user after free due to a race condition. Affects :unknown: versions >= SoCVersion:0, < SoCVersion:2022-09-05. Fixed in SoCVersion:2022-09-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The affected package is part of the Android ecosystem, specifically related to graphics processing. It plays a crucial role in managing data transfers between the graphics hardware and the operating system. This package is essential for ensuring smooth graphics rendering and overall performance in Android devices. However, it has been identified with a vulnerability that could potentially allow local escalation of privileges due to improper memory management.
Vulnerability Detail
In the function PVRSRVRGXSubmitTransferKM located in rgxtransfer.c, a race condition can lead to a user after free scenario. This occurs when memory that has been freed is still accessed, which can result in unpredictable behavior or exploitation. The vulnerability allows an attacker to escalate privileges locally without needing additional execution privileges. User interaction is not required for exploitation, making it a significant security concern.
How To Fix
Minimum fixed version
SoCVersion:2022-09-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds have been provided for this vulnerability. The best course of action is to apply the available patch as soon as possible.
Conclusion
CVE-2021-0697 is a critical vulnerability affecting the Android graphics processing package, allowing for local privilege escalation due to a user after free condition. Users are strongly advised to update their systems to the patched version to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2021-0697 is a vulnerability in the Android graphics processing package that can lead to local privilege escalation due to a user after free condition.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor vulnerabilities without any signup.
If exploited, this vulnerability could allow an attacker to gain elevated privileges on the device, potentially leading to unauthorized access to sensitive information or system controls.
No, user interaction is not needed for exploitation, which makes this vulnerability particularly dangerous.
If you cannot update your device, consider using Vulert to monitor for vulnerabilities and assess the risk until you can apply the necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
