Summary
Google heeft kwetsbaarheden verholpen in Android.
Samsung heeft de voor Samsung mobile devices relevante kwetsbaarheden verholpen in Samsung Mobile.
Details
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, zichzelf verhoogde rechten toe te kennen of willekeurige code uit te voeren.
De ernstigste kwetsbaarheid heeft kenmerk CVE-2024-40673 toegewezen gekregen en bevindt zich in de kernel van Android. Deze kwetsbaarheid stelt een kwaadwillende in staat om willekeurige code uit te voeren op het systeem.
Google heeft verder, zoals gebruikelijk, weinig detailinformatie beschikbaar gesteld.
Oplossingen
Google heeft updates uitgebracht om de kwetsbaarheden te verhelpen in Android 12,13 en 14.
Samsung heeft updates uitgebracht om de voor Samsung relevante kwetsbaarheden te verhelpen in Samsung Mobile devices.
Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 34
-
Critical 9.8
In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to remote cod…
-
Critical 9.8
In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to remote cod…
-
Critical 9.8
In wlan firmware, there is a possible out of bounds write due to improper input validation. This could lead to remote c…
-
High 8.4
In RGXMMUCacheInvalidate of rgxmem.c, there is a possible arbitrary code execution due to a race condition. This could …
-
High 8.4
In DevmemXIntMapPages of devicemem_server.c, there is a possible arbitrary code execution due to an integer overflow. T…
-
High 8.4
In _DevmemXReservationPageAddress of devicemem_server.c, there is a possible use-after-free due to improper casting. Th…
-
High 8.4CVE-2024-38399 Public exploit
Use After Free in Graphics
Memory corruption while processing user packets to generate page faults.
-
High 8.4
In TBD of TBD, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation…
-
High 8.4
In TBD of TBD, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation…
-
High 8.4
In TBD of TBD, there is a possible use after free due to a race condition. This could lead to local escalation of privi…
-
High 8.4
In TBD of TBD, there is a possible use after free due to a race condition. This could lead to local escalation of privi…
-
High 8.4
In onCreate of ChooserActivity.java, there is a possible way to bypass factory reset protections due to a missing permi…
-
High 8.4
In shouldSkipForInitialSUW of AdvancedPowerUsageDetail.java, there is a possible way to bypass factory reset protection…
-
High 7.8CVE-2024-0044 Public exploit
In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input vali…
-
High 7.8
In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of …
-
High 7.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in HLOS
Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers.
-
High 7.7CVE-2024-40676 Public exploit
In checkKeyIntent of AccountManagerService.java, there is a possible way to bypass intent security check and install an…
-
High 7.5
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service w…
-
High 7.5
Buffer Over-read in WLAN Host Communication
Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.
-
High 7.5
Use After Free in WLAN Host
Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host.
-
High 7.5
Out-of-bounds write in parsing h.264 format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers…
-
High 7.5
Out-of-bounds write in parsing h.264 format in a specific mode in librtppayload.so prior to SMR Oct-2024 Release 1 allo…
-
High 7.5
Out-of-bounds write in parsing h.265 format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers…
-
High 7.5
Out-of-bounds write in parsing h.263 format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers…
-
High 7.5
Out-of-bounds write in parsing h.263+ format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attacker…
-
High 7.5
In parseUriInternal of Intent.java, there is a possible infinite loop due to improper input validation. This could lead…
-
Medium 6.7
In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of …
-
Medium 6.5
In Source of ZipFile.java, there is a possible way for an attacker to execute arbitrary code by manipulating Dynamic Co…
-
Medium 6.2
Improper access control in ActivityManager prior to SMR Oct-2024 Release 1 in select Android 12, 13 and SMR Sep-2024 Re…
-
Medium 5.3
Integer overflow in libSEF.quram.so prior to SMR Oct-2024 Release 1 allows local attackers to write out-of-bounds memor…
-
Medium 5.3
In validateSsid of WifiConfigurationUtil.java, there is a possible way to overflow a system configuration file due to a…
-
Medium 4.4
In vdec, there is a possible out of bounds read due to a missing bounds check. This could lead to local information dis…
-
Medium 4.4
In vdec, there is a possible out of bounds read due to a missing bounds check. This could lead to local information dis…
-
Medium 4.1
Improper check for exception conditions in Knox Guard prior to SMR Oct-2024 Release 1 allows physical attackers to bypa…
Revision history
-
#0
Initiele versie
References
-
Reference - hkcert
https://source.android.com/docs/security/bulletin/2024-10-01
-
Reference - cveprojectv5; nvd
https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=10