In multiple functions of quirks.c, there is a possible way to free arbitrary memory due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "vanir_signatures": [ { "digest": { "length": 1011.0, "function_hash": "19012591602693493290712050937359852809" }, "id": "ASB-A-382243530-008c429d", "source": "https://android.googlesource.com/kernel/common/+/a84242054bec905a3c63d5701256a6f4af6bce81", "deprecated": false, "signature_version": "v1", "target": { "file": "sound/usb/quirks.c", "function": "snd_usb_extigy_boot_quirk" }, "signature_type": "Function" }, { "digest": { "length": 1011.0, "function_hash": "19012591602693493290712050937359852809" }, "id": "ASB-A-382243530-1033a9b3", "source": "https://android.googlesource.com/kernel/common/+/5486704a6a0c592692efe67461dfa8db51fdc684", "deprecated": false, "signature_version": "v1", "target": { "file": "sound/usb/quirks.c", "function": "snd_usb_extigy_boot_quirk" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "4596325388915008981299882468003979678", "117538277251158576169632553323025276867", "128720640318649124984724844766591494427", "248388793769995810708961935945717898508", "18583310606235471713331773034534499253", "38442455409447277707644901197745318391", "13899572167681943313544065699117070482", "147545270504045940631543831775116095149", "165726875418486070304294400466485754803", "204804844893188247352894776146587916295", "293241501077110442061361593328233040718", "229479838302465359324651441298612498710", "326243252985604367500262435109357834875", "68647310966918190091767486171462814763", "22336160152296457165851039365302580492", "250352466211041736840666677877697125206", "277448354138740027466293073524968999005", "13899572167681943313544065699117070482", "147545270504045940631543831775116095149", "165726875418486070304294400466485754803", "204804844893188247352894776146587916295", "293241501077110442061361593328233040718", "302580069370621221734915655222288481720", "228123083587912899020469896689621053267", "845121499220581854700123676984591825", "148906423356710753373076640961531287768", "250352466211041736840666677877697125206", "277448354138740027466293073524968999005", "13899572167681943313544065699117070482", "147545270504045940631543831775116095149", "165726875418486070304294400466485754803", "204804844893188247352894776146587916295", "293241501077110442061361593328233040718" ] }, "id": "ASB-A-382243530-33559e2d", "source": "https://android.googlesource.com/kernel/common/+/a84242054bec905a3c63d5701256a6f4af6bce81", "deprecated": false, "signature_version": "v1", "target": { "file": "sound/usb/quirks.c" }, "signature_type": "Line" }, { "digest": { "length": 901.0, "function_hash": "149865222751904324294654490599554875005" }, "id": "ASB-A-382243530-4493cd02", "source": "https://android.googlesource.com/kernel/common/+/a84242054bec905a3c63d5701256a6f4af6bce81", "deprecated": false, "signature_version": "v1", "target": { "file": "sound/usb/quirks.c", "function": "snd_usb_mbox3_boot_quirk" }, "signature_type": "Function" }, { "digest": { "length": 1536.0, "function_hash": "114082801913863411111916967027200975283" }, "id": "ASB-A-382243530-88dcb9c3", "source": "https://android.googlesource.com/kernel/common/+/a84242054bec905a3c63d5701256a6f4af6bce81", "deprecated": false, "signature_version": "v1", "target": { "file": "sound/usb/quirks.c", "function": "snd_usb_mbox2_boot_quirk" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "4596325388915008981299882468003979678", "117538277251158576169632553323025276867", "128720640318649124984724844766591494427", "248388793769995810708961935945717898508", "18583310606235471713331773034534499253", "38442455409447277707644901197745318391", "13899572167681943313544065699117070482", "147545270504045940631543831775116095149", "165726875418486070304294400466485754803", "204804844893188247352894776146587916295", "293241501077110442061361593328233040718", "229479838302465359324651441298612498710", "326243252985604367500262435109357834875", "68647310966918190091767486171462814763", "22336160152296457165851039365302580492", "250352466211041736840666677877697125206", "277448354138740027466293073524968999005", "13899572167681943313544065699117070482", "147545270504045940631543831775116095149", "165726875418486070304294400466485754803", "204804844893188247352894776146587916295", "293241501077110442061361593328233040718", "114703726274791127071022913378976971627", "205525993595208785241876160429196459346", "51455053824969455025319149621323926812" ] }, "id": "ASB-A-382243530-99f67a90", "source": "https://android.googlesource.com/kernel/common/+/5486704a6a0c592692efe67461dfa8db51fdc684", "deprecated": false, "signature_version": "v1", "target": { "file": "sound/usb/quirks.c" }, "signature_type": "Line" }, { "digest": { "length": 1536.0, "function_hash": "114082801913863411111916967027200975283" }, "id": "ASB-A-382243530-9afb40ae", "source": "https://android.googlesource.com/kernel/common/+/5486704a6a0c592692efe67461dfa8db51fdc684", "deprecated": false, "signature_version": "v1", "target": { "file": "sound/usb/quirks.c", "function": "snd_usb_mbox2_boot_quirk" }, "signature_type": "Function" } ], "fixes": [ "https://android.googlesource.com/kernel/common/+/5486704a6a0c592692efe67461dfa8db51fdc684", "https://android.googlesource.com/kernel/common/+/a84242054bec905a3c63d5701256a6f4af6bce81" ], "spl": "2025-04-05", "severity": "High", "types": [ "EoP" ] }