CVE-2021-0920

MediumCVSS 6.4/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Dec 15, 2021
Last modified
Jun 17, 2026
Added to CISA KEV
May 23, 2022
NVD status
Analyzed

Related CVEs from 2021

CVE-2021-09217.8In ParsingPackageImpl of ParsingPackageImpl.java, there is a possible parcel serialization/deserialization mismatch due to improper input vaCVE-2021-09227.8In enforceCrossUserOrProfilePermission of PackageManagerService.java, there is a possible bypass of INTERACT_ACROSS_PROFILES permission due CVE-2021-09237.8In createOrUpdate of Permission.java, there is a possible way to gain internal permissions due to a missing permission check. This could leaCVE-2021-09247.8In xhci_vendor_get_ops of xhci.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation CVE-2021-09257.5In rw_t4t_sm_detect_ndef of rw_t4t.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote inCVE-2021-09267.8In onCreate of NfcImportVCardActivity.java, there is a possible way to add a contact without user's consent due to a missing permission checCVE-2021-09277.8In requestChannelBrowsable of TvInputManagerService.java, there is a possible permission bypass due to a logic error in the code. This couldCVE-2021-09287.8In createFromParcel of OutputConfiguration.java, there is a possible parcel serialization/deserialization mismatch due to improper input valCVE-2021-09297.8In ion_dma_buf_end_cpu_access and related functions of ion.c, there is a possible way to corrupt memory due to a use after free. This could CVE-2021-09308.8In phNxpNciHal_process_ext_rsp of phNxpNciHal_ext.cc, there is a possible out of bounds write due to a missing bounds check. This could leadCVE-2021-09315.5In getAlias of BluetoothDevice.java, there is a possible way to create misleading permission dialogs due to missing data filtering. This couCVE-2021-09327.8In showNotification of NavigationModeController.java, there is a possible confused deputy due to an unsafe PendingIntent. This could lead to