Summary
Google heeft meerdere kwetsbaarheden verholpen in Android en Samsung Mobile, waaronder twee zero-day kwetsbaarheden die actief werden uitgebuit in gerichte aanvallen.
Details
Interpretaties
De kwetsbaarheden bevinden zich in de Android-kernel en de ExternalStorageProvider.java, wat kan leiden tot lokale privilege-escalatie en remote code-executie. Daarnaast kunnen verschillende kwetsbaarheden remote aanvallers in staat stellen om denial-of-service te veroorzaken of gevoelige gegevens te benaderen. De kwetsbaarheden treffen verschillende versies van Android en Samsung-producten, wat onmiddellijke aandacht van beveiligingsbeheerders vereist.
Google meldt informatie te hebben ontvangen dat de kwetsbaarheden met kenmerk CVE-2024-43093 en CVE-2024-50302 beperkt en gericht zijn misbruikt. Deze kwetsbaarheden bevinden zich respectievelijk in het Android Framework en in de Kernel en stellen een kwaadwillende in staat zich verhoogde rechten toe te kennen en toegang te krijgen tot gevoelige gegevens. Voor zover bekend moet voor succesvol misbruik de kwaadwillende het slachtoffer misleiden een malafide app te installeren.
Oplossingen
Google heeft fixes geïmplementeerd om deze risico's te mitigeren, terwijl Samsung soortgelijke problemen in zijn apparaten heeft aangepakt. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 41
-
High 7.3
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to pre…
KEV Nov 7, 2024 -
Medium 5.5CVE-2024-50302 Exploited
HID: core: zero-initialize the report buffer
In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be …
KEV Mar 4, 2025 -
Critical 9.8
In process_service_attr_rsp of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after f…
-
Critical 9.8
In process_service_search_attr_req of sdp_server.cc, there is a possible way to execute arbitrary code due to a use aft…
-
Critical 9.8
In sdp_snd_service_search_req of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after…
-
Critical 9.8
In rfc_check_send_cmd of rfc_utils.cc, there is a possible way to execute arbitrary code due to a use after free. This …
-
High 8.8
In multiple locations, there is a possible out of bounds write due to a use after free. This could lead to remote code …
-
High 8.8
In process_service_attr_rsp of sdp_discovery.cc, there is a possible use after free due to a logic error in the code. T…
-
High 8.8
In multiple functions of sdp_server.cc, there is a possible use after free due to a logic error in the code. This could…
-
High 8.4
In avct_lcb_msg_ind of avct_lcb_act.cc, there is a possible way to execute arbitrary code due to a use after free. This…
-
High 8.4
In multiple locations, there is a possible way to execute arbitrary code due to a use after free. This could lead to lo…
-
High 8.4
In bnepu_check_send_packet of bnep_utils.cc, there is a possible way to achieve code execution due to a use after free.…
-
High 8.4
In rfc_send_buf_uih of rfc_ts_frames.cc, there is a possible way to execute arbitrary code due to a use after free. Thi…
-
High 8.4
In multiple locations, there is a possible way to execute arbitrary code due to a use after free. This could lead to lo…
-
High 8.2
Buffer Over-read in WLAN HOST
Information disclosure while parsing the OCI IE with invalid length.
-
High 8.0CVE-2023-21125 Public exploit
In btif_hh_hsdata_rpt_copy_cb of bta_hh.cc, there is a possible way to corrupt memory due to a use after free. This cou…
-
High 7.9
Permissions, Privileges, and Access Controls in Video Analytics and Processing
Information disclosure may occur due to improper permission and access controls to Video Analytics engine.
-
High 7.8
dma-buf: heaps: Fix off-by-one in CMA heap fault handler
In the Linux kernel, the following vulnerability has been resolved: dma-buf: heaps: Fix off-by-one in CMA heap fault handler Until VM_DONTEXPAND was added in commit 1c1914d6e8c6 ("dma-buf: heaps: Don't track CMA dma-buf pages under RssFile") it was possible t…
-
High 7.8
Improper Validation of Array Index in Camera
Memory corruption may occur during the synchronization of the camera`s frame processing pipeline.
-
High 7.8
Improper Validation of Array Index in Audio
Memory corruption may occur while validating ports and channels in Audio driver.
-
High 7.8
NULL Pointer Dereference in Display
Memory corruption in display driver while detaching a device.
-
High 7.8
In multiple locations, there is a possible way that avdtp and avctp channels could be unencrypted due to a logic error …
-
High 7.8
In KeyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalati…
-
High 7.5CVE-2024-53027 Public exploit
Buffer Copy Without Checking Size of Input in WLAN Host
Transient DOS may occur while processing the country IE.
-
High 7.5
In dng_lossless_decoder::HuffDecode of dng_lossless_jpeg.cpp, there is a possible way to cause a crash due to uninitial…
-
High 7.5
In handleBondStateChanged of AdapterService.java, there is a possible unapproved data access due to a missing permissio…
-
High 7.3
Improper access control in SecSettingsIntelligence prior to SMR Mar-2025 Release 1 allows local attackers to launch pri…
-
Medium 6.5
In handleBondStateChanged of AdapterService.java, there is a possible permission bypass due to misleading or insufficie…
-
Medium 6.5
In Modem, there is a possible memory corruption due to incorrect error handling. This could lead to remote denial of se…
-
Medium 6.5
Use of insufficiently random values in Auracast prior to SMR Mar-2025 Release 1 allows adjacent attackers to access Aur…
-
Medium 6.2
Incorrect default permission in Galaxy Watch Gallery prior to SMR Mar-2025 Release 1 allows local attackers to access d…
-
Medium 6.2
Incorrect default permission in DiagMonAgent prior to SMR Mar-2025 Release 1 allows local attackers to access data with…
-
Medium 5.5
Improper Authorization in SPS-HLOS
Information disclosure while deriving keys for a session for any Widevine use case.
-
Medium 5.5
In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused…
-
Medium 5.5
Integer Overflow or Wraparound in BT Controller
Transient DOS can occur while processing UCI command.
-
Medium 5.5
In multiple functions of StatusHint.java and TelecomServiceImpl.java, there is a possible way to reveal images across u…
-
Medium 5.5
In hidd_check_config_done of hidd_conn.cc, there is a possible way to execute arbitrary code due to a use after free. T…
-
Medium 4.4
Improper access control in sem_wifi service prior to SMR Mar-2025 Release 1 allows privileged local attackers to update…
-
Medium 4.0
Use of implicit intent for sensitive communication in Settings prior to SMR Mar-2025 Release 1 allows local attackers t…
-
Medium 4.0
In multiple functions of hyp-main.c, there is a possible privilege escalation due to a logic error in the code. This co…
-
Medium 4.0CVE-2025-26417 Public exploit
In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening fi…
Revision history
-
#0
Initiele versie
References
-
Reference - ncscclear
https://source.android.com/docs/security/bulletin/2025-03-01
-
Reference - ncscclear
https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=03