Summary
Google heeft kwetsbaarheden verholpen in Android.
Details
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om zich verhoogde rechten toe te kennen op het device en zo willekeurige code uit te voeren, mogelijk met rechten van het systeem en toegang krijgen tot gevoelige gegevens.
Voor succesvol misbruik moet de kwaadwillende het slachtoffer misleiden een malafide app te installeren en draaien of een malafide link te volgen.
In deze update wordt ook de kwetsbaarheid met kenmerk CVE-2024-32896 verholpen. Deze bevindt zich in het Android Framework en stelt een lokale kwaadwillende in staat om zich verhoogde rechten toe te kennen en code uit te voeren met rechten van het systeem. Van deze kwetsbaarheid meldt Google dat deze zeer beperkt en gericht is misbruikt als ZeroDay op Google Pixel. Er is (nog) geen publieke Proof-of-Concept of exploit beschikbaar.
In deze update zijn ook kwetsbaarheden verholpen in closed-source componenten van Arm, Imagination Technologies, Unisoc en Qualcomm. Google heeft verder weinig inhoudelijke informatie bekend gesteld.
Oplossingen
Google heeft updates uitgebracht om de kwetsbaarheden te verhelpen in Android 12,13 en 14.
Samsung heeft updates uitgebracht om de voor Samsung relevante kwetsbaarheden te verhelpen in Samsung Mobile devices.
Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 53
-
High 8.1CVE-2024-32896 Exploited
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege wi…
KEV Jun 13, 2024 -
High 8.4
Use After Free in SCE-Mink
Memory corruption while releasing shared resources in MinkSocket listener thread.
-
High 8.4
In PVRSRVBridgeRGXKickTA3D2 of server_rgxta3d_bridge.c, there is a possible arbitrary code execution due to improper in…
-
High 8.4
Use After Free in Graphics Linux
Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time.
-
High 8.4
Integer Overflow or Wraparound in Display
Memory corruption while calculating total metadata size when a very high reserved size is requested by gralloc clients.
-
High 8.4
Return of Stack Variable Address in Buses
Memory corruption when BTFM client sends new messages over Slimbus to ADSP.
-
High 8.4
Use After Free in DSP Service
Memory corruption when two threads try to map and unmap a single node simultaneously.
-
High 8.3
In UMTS RLC driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote de…
-
High 8.3
In UMTS RLC driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote den…
-
High 8.2
Buffer Over-read in Multi Mode Call Processor
Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.
-
High 7.8
Untrusted Pointer Dereference in Computer Vision
Memory corruption while passing untrusted/corrupted pointers from DSP to EVA.
-
High 7.8
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host
Memory corruption when Alternative Frequency offset value is set to 255.
-
High 7.8
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host
Memory corruption when user provides data for FM HCI command control operations.
-
High 7.8
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Computer Vision
Memory corruption during the handshake between the Primary Virtual Machine and Trusted Virtual Machine.
-
High 7.8
Mali GPU Kernel Driver allows improper GPU memory processing operations
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to alr…
-
High 7.8
af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock.
In the Linux kernel, the following vulnerability has been resolved: af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock. Billy Jheng Bing-Jhong reported a race between __unix_gc() and queue_oob(). __unix_gc() tries to garbage-collect close()d inf…
-
High 7.8
In wifi_item_edit_content of styles.xml , there is a possible FRP bypass due to Missing check for FRP state. This could…
-
High 7.8
In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalat…
-
High 7.8
In bindAndGetCallIdentification of CallScreeningServiceHelper.java, there is a possible way to maintain a while-in-use …
-
High 7.8
In addPreferencesForType of AccountTypePreferenceLoader.java, there is a possible way to disable apps for other users d…
-
High 7.8
In getConfig of SoftVideoDecoderOMXComponent.cpp, there is a possible out of bounds write due to a heap buffer overflow…
-
High 7.8
In scheme of Uri.java, there is a possible way to craft a malformed Uri object due to improper input validation. This c…
-
High 7.5
Buffer Over-read in Multi Mode Call Processor
Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in Modem.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of a beacon frame that is received from over-the-air (OTA).
-
High 7.5
Buffer Over-read in WLAN Host
Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
-
High 7.5
Buffer Over-read in WLAN Host Communication
Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
-
High 7.5
Buffer Over-read in WLAN Host Communication
Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.
-
High 7.4
In DevmemIntPFNotify of devicemem_server.c, there is a possible use-after-free due to a race condition. This could lead…
-
High 7.3
In onCreate of SettingsHomepageActivity.java, there is a possible way to access the Settings app while the device is pr…
-
High 7.1
Improper Input Validation in Trusted Execution Environment
Cryptographic issue while parsing RSA keys in COBR format.
-
Medium 6.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage
memory corruption when an invalid firehose patch command is invoked.
-
Medium 6.7
Improper handling of exceptional conditions in ThemeCenter prior to SMR Sep-2024 Release 1 allows local attackers to de…
-
Medium 6.6
Improper access control in DualDarManagerProxy prior to SMR Sep-2024 Release 1 allows local attackers to cause local pe…
-
Medium 6.2
Improper access control in WindowManagerService prior to SMR Sep-2024 Release 1 in Android 12, and SMR Jun-2024 Release…
-
Medium 6.2
Improper authorization in My Files prior to SMR Sep-2024 Release 1 allows local attackers to access restricted data in …
-
Medium 6.2
Improper Export of android application component in My Files prior to SMR Sep-2024 Release 1 allows local attackers to …
-
Medium 6.2
Incorrect use of privileged API in UniversalCredentialManager prior to SMR Sep-2024 Release 1 allows local attackers to…
-
Medium 6.1
Improper input validation in ThemeCenter prior to SMR Sep-2024 Release 1 allows physical attackers to install privilege…
-
Medium 5.5
Buffer Over-read in FM Host
Transient DOS while handling PS event when Program Service name length offset value is set to 255.
-
Medium 5.5
In handleCreateConferenceComplete of ConnectionServiceWrapper.java, there is a possible way to reveal images across use…
-
Medium 5.5
In getRegistration of RemoteProvisioningService.java, there is a possible way to permanently disable the AndroidKeyStor…
-
Medium 5.1
Improper Export of Android Application Components in FeliCaTest prior to SMR Sep-2024 Release 1 allows local attackers …
-
Medium 5.1
Improper Handling of Insufficient Permissions in KnoxMiscPolicy prior to SMR Sep-2024 Release 1 allows local attackers …
-
Medium 4.6
Improper authorization in One UI Home prior to SMR Sep-2024 Release 1 allows physical attackers to temporarily access s…
-
Medium 4.6
Path Traversal in My Files prior to SMR Sep-2024 Release 1 allows physical attackers to access directories with My File…
-
Medium 4.4
Improper access control in key input related function in Dressroom prior to SMR Sep-2024 Release 1 allows local attacke…
-
Medium 4.4
Improper access control in item selection related in Dressroom prior to SMR Sep-2024 Release 1 allows local attackers t…
-
Medium 4.0
Incorrect use of privileged API in DualDarManagerProxy prior to SMR Sep-2024 Release 1 allows local attackers to access…
-
Medium 4.0
Incorrect authorization in CocktailbarService prior to SMR Sep-2024 Release 1 allows local attackers to access privileg…
-
Medium 4.0
Incorrect authorization in kperfmon prior to SMR Sep-2024 Release 1 allows local attackers to access information relate…
-
Low 3.3
Improper access control vulnerability in BGProtectManager prior to SMR Sep-2024 Release 1 allows local attackers to byp…
-
Low 2.4
Improper access control in new Dex Mode in multitasking framework prior to SMR Sep-2024 Release 1 allows physical attac…
Revision history
-
#0
Initiele versie
References
-
Reference - cveprojectv5; nvd
https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=09
-
Reference - certbundde; hkcert
https://source.android.com/docs/security/bulletin/2024-09-01