Summary
Google heeft kwetsbaarheden verholpen in Android.
Details
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, of zich verhoogde rechten toe te kennen op het device en zo willekeurige code uit te voeren, mogelijk met rechten van het systeem en toegang krijgen tot gevoelige gegevens.
Voor succesvol misbruik moet de kwaadwillende het slachtoffer misleiden een malafife app te installeren en draaien of een malafide link te volgen.
In deze update zijn ook kwetsbaarheden verholpen in closed-source componenten van Arm, Imagination Technologies, MediaTek en Qualcomm. Google heeft verder weinig inhoudelijke informatie bekend gesteld.
Oplossingen
Google heeft updates uitgebracht om de kwetsbaarheden te verhelpen in Android 12,13 en 14.
Samsung heeft updates uitgebracht om de voor Samsung relevante kwetsbaarheden te verhelpen in Samsung Mobile devices.
Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 62
-
High 7.8
net: fix __dst_negative_advice() race
In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first c…
KEV Aug 7, 2024 -
Critical 9.8
In Modem, there is a possible memory corruption due to a missing bounds check. This could lead to remote code execution…
-
High 8.4
Improper Restriction of Operations within the Bounds of a Memory Buffer in Hypervisor
Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager.
-
High 8.4
Use After Free in Graphics Linux
Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU.
-
High 8.4
Use After Free in Graphics Linux
Memory corruption while processing graphics kernel driver request to create DMA fence.
-
High 8.4
Use After Free in Graphics Linux
Memory corruption when kernel driver attempts to trigger hardware fences.
-
High 8.4
Use After Free in Graphics Linux
Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker.
-
High 8.4
Use After Free in Graphics Linux
Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.
-
High 8.4
Improper Access Control in Graphics Linux
Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table.
-
High 8.4
Use After Free in Automotive Telematics
Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released.
-
High 8.4
Improper privilege management in SumeNNService prior to SMR Aug-2024 Release 1 allows local attackers to start privileg…
-
High 7.8
In removePermission of PermissionManagerServiceImpl.java, there is a possible way to obtain dangerous permissions witho…
-
High 7.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in Automotive
Memory corruption when keymaster operation imports a shared key.
-
High 7.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in HLOS
Memory corruption during session sign renewal request calls in HLOS.
-
High 7.8
Mali GPU Kernel Driver allows improper GPU memory processing operations
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to alr…
-
High 7.8
In _MMU_AllocLevel of mmu_common.c, there is a possible arbitrary code execution due to an integer overflow. This could…
-
High 7.8CVE-2024-34739 Public exploit
In shouldRestrictOverlayActivities of UsbProfileGroupSettingsManager.java, there is a possible escape from SUW due to a…
-
High 7.8CVE-2024-34741 Public exploit
In setForceHideNonSystemOverlayWindowIfNeeded of WindowState.java, there is a possible way for message content to be vi…
-
High 7.8
In setTransactionState of SurfaceFlinger.cpp, there is a possible way to perform tapjacking due to a logic error in the…
-
High 7.8
Mali GPU Kernel Driver allows improper GPU memory processing operations
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to alr…
-
High 7.7
In multiple locations, there is a possible background activity launch due to a logic error in the code. This could lead…
-
High 7.7
In multiple functions of TranscodingResourcePolicy.cpp, there is a possible memory corruption due to a race condition. …
-
High 7.7
In onForegroundServiceButtonClicked of FooterActionsViewModel.kt, there is a possible way to disable the active VPN app…
-
High 7.7
In ensureSetPipAspectRatioQuotaTracker of ActivityClientController.java, there is a possible way to generate unmovable …
-
High 7.7
In multiple functions of AppOpsService.java, there is a possible way for unprivileged apps to read their own restrictRe…
-
High 7.7CVE-2024-34740 Public exploit
In attributeBytesBase64 and attributeBytesHex of BinaryXmlSerializer.java, there is a possible arbitrary XML injection …
-
High 7.5
Loop with Unreachable Exit Condition (`Infinite Loop`) in Multi Mode Call Processor
Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA.
-
High 7.5
Buffer Over-read in Multi Mode Call Processor
Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.
-
High 7.5
Use After Free in WLAN Host
Transient DOS while parsing fragments of MBSSID IE from beacon frame.
-
High 7.5
Buffer Over-read in WLAN Host
Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.
-
High 7.5
Buffer Over-read in WLAN Host
Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.
-
High 7.5
Buffer Over-read in WLAN Host
Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.
-
High 7.5
Buffer Over-read in WLAN Host
Transient DOS while parsing ESP IE from beacon/probe response frame.
-
High 7.5
Buffer Over-read in WLAN Host
Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report.
-
High 7.5
Buffer Over-read in WLAN Host
Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.
-
High 7.5
Buffer Over-read in WLAN Host
Transient DOS while parsing the received TID-to-link mapping action frame.
-
High 7.5
Buffer Over-read in WLAN HOST
Transient DOS while processing TID-to-link mapping IE elements.
-
High 7.5
Integer Overflow or Wraparound in WLAN Host
Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length.
-
High 7.5
Buffer Over-read in WLAN Host
Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
-
High 7.5
Buffer Over-read in WLAN Host
Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.
-
High 7.5
Improper input validation in librtp.so prior to SMR Aug-2024 Release 1 allows remote attackers to execute arbitrary cod…
-
High 7.5
In sdpu_compare_uuid_with_attr of sdp_utils.cc, there is a possible out of bounds read due to a heap buffer overflow. T…
-
High 7.3
Out-of-bound write in libcodec2secmp4vdec.so prior to SMR Aug-2024 Release 1 allows local attackers to execute arbitrar…
-
High 7.3
Out-of-bound write in libsmat.so prior to SMR Aug-2024 Release 1 allows local attackers to execute arbitrary code.
-
Medium 6.5
Reachable Assertion in Multi Mode Call Processor
Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is LPP where UE needs to send status message to network.
-
Medium 6.2
NULL Pointer Dereference in Graphics
transient DOS when setting up a fence callback to free a KGSL memory entry object during DMA.
-
Medium 6.2
NULL Pointer Dereference in HLOS
Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus.
-
Medium 6.2
Improper access control in LedCoverService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restriction…
-
Medium 6.2
Improper access control in SamsungHealthService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restri…
-
Medium 6.2
Improper access control in SmartThingsService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrict…
-
Medium 6.2
Improper access control in SamsungNotesService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restric…
-
Medium 6.2
Improper access control in PaymentManagerService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restr…
-
Medium 6.2
Improper access control in VoiceNoteService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictio…
-
Medium 6.2
In setupVideoEncoder of StagefrightRecorder.cpp, there is a possible asynchronous playback when B-frame support is enab…
-
Medium 5.5
In shouldWrite of OwnersData.java, there is a possible edge case that prevents MDM policies from being persisted due to…
-
Medium 5.1
Improper access control in ExtControlDeviceService prior to SMR Aug-2024 Release 1 allows local attackers to access pro…
-
Medium 5.1
Improper access control in KnoxService prior to SMR Aug-2024 Release 1 allows local attackers to get sensitive informat…
-
Medium 5.1
Out-of-bound write in libsmat.so prior to SMR Aug-2024 Release 1 allows local attackers to cause memory corruption.
-
Medium 5.1
Improper handling of insufficient permission in KnoxDualDARPolicy prior to SMR Aug-2024 Release 1 allows local attacker…
-
Medium 4.0
Improper access control in Galaxy Watch prior to SMR Aug-2024 Release 1 allows local attackers to access sensitive info…
-
Medium 4.0
Improper handling of insufficient permission in Telephony prior to SMR Aug-2024 Release 1 allows local attackers to con…
-
Medium 4.0
Improper access control in System property prior to SMR Aug-2024 Release 1 allows local attackers to access cell relate…
Revision history
-
#0
Initiele versie
References
-
Reference - cveprojectv5; nvd
https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html
-
Reference - hkcert
https://source.android.com/docs/security/bulletin/2024-08-01