Summary
Google heeft kwetsbaarheden verholpen in Android.
In deze update zijn ook updates meegenomen voor closed-source componenten van Qualcomm, Imagination Technologies en MediaTek.
Samsung heeft kwetsbaarheden in Samsung Mobile verholpen die relevant zijn voor Samsung mobile devices.
Details
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, zichzelf verhoogde rechten toe te kennen, toegang te krijgen tot gevoelige gegevens of willekeurige code uit te voeren.
Voor succesvol misbruik moet de kwaadwillende het slachtoffer misleiden een malafide app te installeren en draaien, of een malafide link te volgen.
Van de kwetsbaarheden met kenmerk CVE-2024-43047 en CVE-2024-43093 geeft Google aan, indicaties te hebben dat deze beperkt en gericht zijn misbruikt. Deze kwetsbaarheden bevinden zich respectievelijk in een gesloten component van Qualcomm en de Android Framework.
Google heeft verder zoals gebruikelijk weinig inhoudelijke informatie beschikbaar gesteld.
Oplossingen
Google heeft updates uitgebracht om de kwetsbaarheden te verhelpen in Android 12,13 en 14.
Samsung heeft updates uitgebracht om kwetsbaarheden die relevant zijn voor Samsung Mobile devices te verhelpen.
Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 53
-
High 7.8CVE-2024-43047 Exploited
Use After Free in DSP Service
Memory corruption while maintaining memory maps of HLOS memory.
KEV Oct 8, 2024 -
High 7.3
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to pre…
KEV Nov 7, 2024 -
Critical 9.8
In filterMask of SkEmbossMaskFilter.cpp, there is a possible out of bounds write due to an integer overflow. This could…
-
High 8.4
In da, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of pr…
-
High 8.4
In PVRSRVRGXKickTA3DKM of rgxta3d.c, there is a possible arbitrary code execution due to improper input validation. Thi…
-
High 8.4
In multiple locations, there is a possible permissions bypass due to a missing null check. This could lead to local esc…
-
High 8.4
In multiple locations, there is a possible arbitrary code execution due to a logic error in the code. This could lead t…
-
High 8.4
In DevmemXIntMapPages of devicemem_server.c, there is a possible use-after-free due to a logic error in the code. This …
-
High 8.4
In getInstalledAccessibilityPreferences of AccessibilitySettings.java, there is a possible way to hide an enabled acces…
-
High 8.4
In multiple functions in AppInfoBase.java, there is a possible way to manipulate app permission settings belonging to a…
-
High 8.2
Cryptographic Issues in BT Controller
Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.
-
High 7.8
In DevmemIntChangeSparse of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in th…
-
High 7.8
In PVRSRVRGXKickTA3DKM of rgxta3d.c, there is a possible arbitrary code execution due to improper input validation. Thi…
-
High 7.8
Untrusted Pointer Dereference in DSP Service
Memory corruption when a compat IOCTL call is followed by another IOCTL call from userspace to a driver.
-
High 7.8
In PMRWritePMPageList of pmr.c, there is a possible out of bounds write due to a logic error in the code. This could le…
-
High 7.8
net: sched: sch_multiq: fix possible OOB write in multiq_tune()
In the Linux kernel, the following vulnerability has been resolved: net: sched: sch_multiq: fix possible OOB write in multiq_tune() q->bands will be assigned to qopt->bands to execute subsequent code logic after kmalloc. So the old q->bands should not be used…
-
High 7.8
Use After Free in DSP Services
Memory corruption while processing IOCTL call for getting group info.
-
High 7.8
Use After Free in Computer Vision
Memory corruption while handling session errors from firmware.
-
High 7.8
Use After Free in Graphics Linux
Memory corruption while processing GPU commands.
-
High 7.8
Integer Overflow to Buffer Overflow in Audio
Memory corruption while processing voice packet with arbitrary data received from ADSP.
-
High 7.8
Buffer Copy Without Checking Size of Input in Graphics Linux
Memory corruption while processing GPU page table switch.
-
High 7.8
Use After Free in GPS
Memory corruption during GNSS HAL process initialization.
-
High 7.8
In setTransactionState of SurfaceFlinger.cpp, there is a possible way to change protected display attributes due to a l…
-
High 7.8
In mayAdminGrantPermission of AdminRestrictedPermissionsUtils.java, there is a possible way to access the microphone du…
-
High 7.8
In DevmemIntChangeSparse2 of devicemem_server.c, there is a possible way to achieve arbitrary code execution due to a m…
-
High 7.8
In onReceive of AppRestrictionsFragment.java, there is a possible escalation of privilege due to unsafe deserialization…
-
High 7.8
In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a l…
-
High 7.8
In handleMessage of UsbDeviceManager.java, there is a possible method to access device contents over USB without unlock…
-
High 7.8
In updateInternal of MediaProvider.java , there is a possible access of another app's files due to a missing permission…
-
High 7.8
binder: fix UAF caused by offsets overwrite
In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF caused by offsets overwrite Binder objects are processed and copied individually into the target buffer during transactions. Any raw data in-between these objects is copied as…
-
High 7.5
Reachable Assertion in Modem
Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS while parsing BTM ML IE when per STA profile is not included.
-
High 7.5
Buffer Over-read in WLAN Host
Transient DOS while processing the CU information from RNR IE.
-
High 7.4
there is a possible escalation of privilege due to an unusual root cause. This could lead to local escalation of privil…
-
Medium 6.7
In m4u, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of p…
-
Medium 6.6
Improper input validation in BluetoothAdapter prior to SMR Nov-2024 Release 1 allows local attackers to cause local per…
-
Medium 6.2
In validate of WifiConfigurationUtil.java , there is a possible persistent denial of service due to resource exhaustion…
-
Medium 6.2
In visitUris of multiple files, there is a possible information disclosure due to a confused deputy. This could lead to…
-
Medium 5.9
Out-of-bounds write in libsapeextractor.so prior to SMR Nov-2024 Release 1 allows local attackers to cause memory corru…
-
Medium 5.5
In onActivityResult of EditUserPhotoController.java, there is a possible cross-user media read due to a confused deputy…
-
Medium 5.5
In validateAccountsInternal of AccountManagerService.java, there is a possible way to leak account credentials to a thi…
-
Medium 5.1
An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 10…
-
Medium 5.1
Improper input validation in Settings Suggestions prior to SMR Nov-2024 Release 1 allows local attackers to launch priv…
-
Medium 5.0
In multiple locations, there is a possible cross-user image read due to a missing permission check. This could lead to …
-
Medium 4.6
Improper access control in Contacts prior to SMR Nov-2024 Release 1 allows physical attackers to access data across mul…
-
Medium 4.6
Improper input validation in Dressroom prior to SMR Nov-2024 Release 1 allow physical attackers to access data across m…
-
Medium 4.4
Out-of-bounds write in parsing subtitle file in libsubextractor.so prior to SMR Nov-2024 Release 1 allows local attacke…
-
Medium 4.1
Improper Input Validation in IpcProtocol in Modem prior to SMR Nov-2024 Release 1 allows local attackers to cause Denia…
-
Medium 4.0
Exposure of sensitive information in System UI prior to SMR Nov-2024 Release 1 allow local attackers to make malicious …
-
Medium 4.0
Incorrect default permissions in Crane prior to SMR Nov-2024 Release 1 allows local attackers to access files with phon…
-
Medium 4.0
Use of implicit intent for sensitive communication in WlanTest prior to SMR Nov-2024 Release 1 allows local attackers t…
-
Low 2.4
Improper access control in Dex Mode prior to SMR Nov-2024 Release 1 allows physical attackers to temporarily access to …
-
Low 2.4
Improper authorization in Settings prior to SMR Nov-2024 Release 1 allows physical attackers to access stored WiFi pass…
Revision history
-
#0
Initiele versie
References
-
Reference - hkcert
https://source.android.com/docs/security/bulletin/2024-11-01
-
Reference - ncscclear
https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=11