CVE-2021-39682

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In mgm_alloc_page of memory_group_manager.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-201677538References: N/A

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Jan 14, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-396836.7In copy_from_mbox of sss_ice_util.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalatCVE-2021-396847.8In target_init of gs101/abl/target/slider/target.c, there is a possible allocation of RWX memory due to a logic error in the code. This coulCVE-2021-396857.8In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an incorrect flag check. This could leaCVE-2021-396867.0In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to a race condition. This could lead CVE-2021-396875.5In HandleTransactionIoEvent of actuator_driver.cc, there is a possible out of bounds read due to a heap buffer overflow. This could lead to CVE-2021-396885.5In TBD of TBD, there is a possible out of bounds read due to TBD. This could lead to local information disclosure with no additional executiCVE-2021-396896.7In multiple functions of odsign_main.cpp, there is a possible way to persist system attack due to a logic error in the code. This could leadCVE-2021-39697.0A Time of Check Time of Use (TOCTOU) vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation,CVE-2021-396905.5In setDisplayPadding of WallpaperManagerService.java, there is a possible way to cause a persistent DoS due to improper input validation. ThCVE-2021-396917.3In WindowManager, there is a possible tapjacking attack due to an incorrect window flag when processing user input. This could lead to localCVE-2021-396927.8In onCreate of SetupLayoutActivity.java, there is a possible way to setup a work profile bypassing user consent due to a tapjacking/overlay CVE-2021-396937.8In onUidStateChanged of AppOpsService.java, there is a possible way to access location without a visible indicator due to a logic error in t
CVE-2021-39682: High severity, CVSS 7.8 | Vulnix