In the OMXNodeInstance::useBuffer and IOMX::freeBuffer functions, there is a possible use after free due to a race condition if the user frees the buffer while it's being used in another thread. This could lead to a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 8.1. Android ID: A-38118127.
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
| Link | Tags |
|---|---|
| http://www.securityfocus.com/bid/102421 | third party advisory vdb entry |
| https://source.android.com/security/bulletin/2018-01-01 | patch vendor advisory |
| http://www.securitytracker.com/id/1040106 | third party advisory vdb entry |