CVE-2021-0920

CVE-2021-0920 is a race condition in the Linux kernel's Unix domain socket implementation (unix_scm_to_skb in af_unix.c) that can lead to a use-after-free memory error (CWE-362/CWE-416). It is triggered by concurrent activity on Unix-domain sockets on the affected device, with no user interaction required, though exploitation requires the attacker to already have System execution privileges. A successful local attacker can escalate their privileges on the device, gaining higher-level access to execute code. Any Android device running a vulnerable Android kernel is affected, and the underlying Linux kernel flaw also exposes Linux-based systems such as Debian. The flaw was added to CISA's Known Exploited Vulnerabilities Catalog on 2022-05-23, indicating it has been exploited in the wild; no public proof-of-concept is known and ransomware use has not been reported.

What to do: Apply Android security updates from Google and device vendors and updated Linux kernel packages from Debian as soon as they are available, per vendor instructions (the required action in CISA's KEV catalog). Because exploitation requires System execution privileges, avoid granting System-level rights to untrusted apps and monitor systems for local privilege escalation activity. Check vendor advisories referencing Android ID A-196926917 or the upstream kernel fix to confirm your kernels are patched.