{"api_version":"1","generated_at":"2026-04-22T21:39:20+00:00","cve":"CVE-2021-39685","urls":{"html":"https://cve.report/CVE-2021-39685","api":"https://cve.report/api/cve/CVE-2021-39685.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-39685","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-39685"},"summary":{"title":"CVE-2021-39685","description":"In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an incorrect flag check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210292376References: Upstream kernel","state":"PUBLIC","assigner":"security@android.com","published_at":"2022-03-16 15:15:00","updated_at":"2022-03-23 16:20:00"},"problem_types":["CWE-787"],"metrics":[],"references":[{"url":"https://source.android.com/security/bulletin/2022-03-01","name":"https://source.android.com/security/bulletin/2022-03-01","refsource":"MISC","tags":[],"title":"Android Security Bulletin—March 2022  |  Android Open Source Project","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-39685","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39685","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"39685","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"google","cpe5":"android","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2021-39685","qid":"159727","title":"Oracle Enterprise Linux Security Update for unbreakable enterprise kernel-container (ELSA-2022-9245)"},{"cve":"CVE-2021-39685","qid":"159729","title":"Oracle Enterprise Linux Security Update for unbreakable enterprise kernel (ELSA-2022-9244)"},{"cve":"CVE-2021-39685","qid":"179012","title":"Debian Security Update for linux (DSA 5050-1)"},{"cve":"CVE-2021-39685","qid":"179117","title":"Debian Security Update for linux (DSA 5096-1)"},{"cve":"CVE-2021-39685","qid":"179118","title":"Debian Security Update for linux (DLA 2940-1)"},{"cve":"CVE-2021-39685","qid":"179119","title":"Debian Security Update for linux-4.19 (DLA 2941-1)"},{"cve":"CVE-2021-39685","qid":"183798","title":"Debian Security Update for linux (CVE-2021-39685)"},{"cve":"CVE-2021-39685","qid":"198659","title":"Ubuntu Security Notification for Linux kernel (OEM) Vulnerabilities (USN-5278-1)"},{"cve":"CVE-2021-39685","qid":"198667","title":"Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5294-1)"},{"cve":"CVE-2021-39685","qid":"198674","title":"Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5294-2)"},{"cve":"CVE-2021-39685","qid":"198676","title":"Ubuntu Security Notification for Linux kernel (GKE) Vulnerabilities (USN-5297-1)"},{"cve":"CVE-2021-39685","qid":"198678","title":"Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5298-1)"},{"cve":"CVE-2021-39685","qid":"198708","title":"Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5337-1)"},{"cve":"CVE-2021-39685","qid":"198731","title":"Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5368-1)"},{"cve":"CVE-2021-39685","qid":"353242","title":"Amazon Linux Security Advisory for kernel : ALAC2012-2022-036"},{"cve":"CVE-2021-39685","qid":"353243","title":"Amazon Linux Security Advisory for kmod-mlx5 : ALAC2012-2022-037"},{"cve":"CVE-2021-39685","qid":"353244","title":"Amazon Linux Security Advisory for kmod-sfc : ALAC2012-2022-038"},{"cve":"CVE-2021-39685","qid":"376925","title":"Alibaba Cloud Linux Security Update for cloud-kernel (ALINUX3-SA-2022:0125)"},{"cve":"CVE-2021-39685","qid":"610401","title":"Google Android Devices March 2022 Security Patch Missing"},{"cve":"CVE-2021-39685","qid":"610408","title":"Google Android April 2022 Security Patch Missing for Huawei EMUI"},{"cve":"CVE-2021-39685","qid":"610409","title":"Google Android April 2022 Security Patch Missing for Samsung"},{"cve":"CVE-2021-39685","qid":"671448","title":"EulerOS Security Update for kernel (EulerOS-SA-2022-1450)"},{"cve":"CVE-2021-39685","qid":"671474","title":"EulerOS Security Update for kernel (EulerOS-SA-2022-1429)"},{"cve":"CVE-2021-39685","qid":"671505","title":"EulerOS Security Update for kernel (EulerOS-SA-2022-1489)"},{"cve":"CVE-2021-39685","qid":"671535","title":"EulerOS Security Update for kernel (EulerOS-SA-2022-1508)"},{"cve":"CVE-2021-39685","qid":"751700","title":"OpenSUSE Security Update for the Linux Kernel (openSUSE-SU-2022:0363-1)"},{"cve":"CVE-2021-39685","qid":"751704","title":"OpenSUSE Security Update for the Linux Kernel (openSUSE-SU-2022:0370-1)"},{"cve":"CVE-2021-39685","qid":"752005","title":"SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:0370-1)"},{"cve":"CVE-2021-39685","qid":"753172","title":"SUSE Enterprise Linux Security Update for the Linux RT Kernel (SUSE-SU-2022:0543-1)"},{"cve":"CVE-2021-39685","qid":"753212","title":"SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:0363-1)"}]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2021-39685","ASSIGNER":"security@android.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"n/a","product":{"product_data":[{"product_name":"Android","version":{"version_data":[{"version_value":"Android kernel"}]}}]}}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Elevation of privilege"}]}]},"references":{"reference_data":[{"refsource":"MISC","name":"https://source.android.com/security/bulletin/2022-03-01","url":"https://source.android.com/security/bulletin/2022-03-01"}]},"description":{"description_data":[{"lang":"eng","value":"In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an incorrect flag check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210292376References: Upstream kernel"}]}},"nvd":{"publishedDate":"2022-03-16 15:15:00","lastModifiedDate":"2022-03-23 16:20:00","problem_types":["CWE-787"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:C/I:C/A:C","accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE","baseScore":7.2},"severity":"HIGH","exploitabilityScore":3.9,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"39685","Ordinal":"215391","Title":"CVE-2021-39685","CVE":"CVE-2021-39685","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"39685","Ordinal":"1","NoteData":"** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.","Type":"Description","Title":null}]}}}