CVE-2021-39648

kernel: possible disclosure of memory due to a race condition in gadget_dev_desc_UDC_show() of configfs.c

Loading…

Severity

Moderate

Red Hat Product Security

4.1

CVSS 3.1

Review impact separately from score.

Published · January 6, 2021

Updated · November 22, 2025

Description

In gadget_dev_desc_UDC_show of configfs.c, there is a possible disclosure of kernel heap memory due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-160822094References: Upstream kernel

Statement

There was no shipped kernel version that was seen affected by this problem. These files are not built in our source code.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 4.1
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')