Summary
Google heeft kwetsbaarheden verholpen in Android.
Details
Interpretaties
De kwetsbaarheden bevinden zich onderandere in de Keymaster trustlet, SmartManagerCN en FreeType. De kwetsbaarheden stellen een lokale aanvaller in staat om code uit te voeren op het apparaat en code uit te voeren met de rechten van SmartManagerCN. Google meldt informatie te hebben ontvangen dat de kwetsbaarheid met kenmerk CVE-2025-27363 beperkt en gericht als zeroday is misbruikt. Deze kwetsbaarheid bevindt zich in FreeType en stelt een kwaadwillende in staat code uit te voeren middels een heap buffer overflow.
Oplossingen
Google heeft updates uitgebracht om de kwetsbaarheden te verhelpen in Android 12,13, 14 en 15. Samsung heeft updates uitgebracht om de voor Samsung relevante kwetsbaarheden te verhelpen in Samsung Mobile devices. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 46
-
High 8.1
An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) whe…
KEV May 6, 2025 -
High 8.8
In smp_process_secure_connection_oob_data of smp_act.cc, there is a possible way to bypass SMP authentication due to In…
-
High 8.2
Buffer Over-read in Multi-Mode Call Processor
Memory corruption while decoding of OTA messages from T3448 IE.
-
High 7.9
GPU DDK - rgxfw_write_robustness_buffer allows arbitrary catreg set mapping
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data into another Guest's virtualised GPU memory.
-
High 7.8
In RemoteSpeechRecognitionService of RemoteSpeechRecognitionService.java, there is a possible way to launch an activity…
-
High 7.8CVE-2024-34739 Public exploit
In shouldRestrictOverlayActivities of UsbProfileGroupSettingsManager.java, there is a possible escape from SUW due to a…
-
High 7.8
Use After Free in DSP Service
Memory corruption while handling multuple IOCTL calls from userspace for remote invocation.
-
High 7.8
GPU DDK - Arbitrary write of read-only dmabuf
Software installed and run as a non-privileged user may conduct improper read/write operations on imported/exported DMA buffers.
-
High 7.8
GPU DDK - Exploitable double free on PTL_STREAM_DESC object in the kernel function TLServerCloseStreamKM due to a race condition
Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.
-
High 7.8
GPU DDK - Multiple integer overflow in DmaTransfer PMR_DevPhysAddr functions leading to OOB writes
Software installed and run as a non-privileged user may conduct improper GPU system calls to access OOB kernel memory.
-
High 7.8
Out-of-bounds Write in SPS Applications
Memory corruption while reading secure file.
-
High 7.8
Detection of Error Condition Without Action in Hypervisor
Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling.
-
High 7.8
Improper Access Control in Hypervisor
Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions.
-
High 7.8
Improper Input Validation in HLOS
Memory corruption during the FRS UDS generation process.
-
High 7.8
GPU DDK - RGXFWIF_HWPERF_CTL_BLK.uiNumCounters OOB write
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write data outside the Guest's virtualised GPU memory.
-
High 7.8
Mali GPU Kernel Driver allows improper GPU memory processing operations
Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to already freed memory. This …
-
High 7.8
Mali GPU Kernel Driver allows access to already freed memory
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU processing operations to gain access to al…
-
High 7.8
Use After Free in GPS HLOS Driver
Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur.
-
High 7.8
Out-of-bounds Write in Computer Vision
Memory corruption while reading the FW response from the shared queue.
-
High 7.8
Out-of-bounds Write in Computer Vision
Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of buffer.
-
High 7.8
In getDestinationForApp of SpaAppBridgeActivity, there is a possible cross-user file reveal due to a logic error in the…
-
High 7.8
In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a secondary user to dis…
-
High 7.8
In clearAllowBgActivityStarts of PendingIntentRecord.java, there is a possible way for an application to launch an acti…
-
High 7.8
In multiple functions of CameraService.cpp, there is a possible way to use the camera from the background due to a perm…
-
High 7.8
In onHandleForceStop of VoiceInteractionManagerService.java, there is a bug that could cause the system to incorrectly …
-
High 7.5
Buffer Over-read in Multi-Mode Call Processor
Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE.
-
High 7.5
Buffer Over-read in WLAN Host Communication
Transient DOS while parsing per STA profile in ML IE.
-
High 7.3
GPU DDK - rgxfw_pcset_ungrab OOB write via psFWMemContext->uiPageCatBaseRegSet
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory.
-
Medium 6.5
In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, i…
-
Medium 6.2
In validateIpConfiguration of WifiConfigurationUtil.java, there is a possible way to trigger a permanent DoS due to a m…
-
Medium 5.5
In collectOps of AppOpsService.java, there is a possible way to cause permanent DoS due to improper input validation. T…
-
Medium 5.5
In onCreate of NotificationAccessConfirmationActivity.java, there is a possible incorrect verification of proper intent…
-
Medium 5.1CVE-2025-0087 Public exploit
In onCreate of UninstallerActivity.java, there is a possible way to uninstall a different user's app due to a missing p…
-
Medium 5.1
In onCreate of InstallStart.java, there is a possible permissions bypass due to improper input validation. This could l…
-
Medium 5.1
In BroadcastController.java of registerReceiverWithFeatureTraced, there is a possible way to receive broadcasts meant f…
-
Medium 4.4
In multiple functions of GrantPermissionsActivity.java , there is a possible way to trick the user into granting the in…
-
Medium 4.4
In multiple locations, there is a possible Android/data access due to a path traversal error. This could lead to local …
-
Medium 4.0
In bta_av_config_ind of bta_av_aact.cc, there is a possible out of bounds read due to type confusion. This could lead t…
-
Medium 4.0
In MMapVAccess of pmr_os.c, there is a possible out of bounds write due to improper input validation. This could lead t…
-
Medium 4.0
In multiple functions of UserController.java, there is a possible lock screen bypass due to a race condition. This coul…
-
Medium 4.0
In multiple locations, there is a possible lock screen bypass due to a logic error in the code. This could lead to loca…
-
Medium 4.0
In dump of WindowManagerService.java, there is a possible way of running dumpsys without the required permission due to…
-
Medium 4.0
In multiple functions of VpnManager.java, there is a possible cross-user data leak due to a logic error in the code. Th…
-
Medium 4.0
In multiple functions of RoleService.java, there is a possible permission squatting vulnerability due to a logic error …
-
Low 3.3
GPU DDK - rgxfw_hwr_log_info OOB write via psHWRInfoBuf->ui32WriteIndex
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory.
-
Low 3.2
In startLockTaskMode of LockTaskController.java, there is a possible lock screen bypass due to a logic error in the cod…
Revision history
-
#1.0.0
Initiele versie
References
-
Source - android
https://source.android.com/docs/security/bulletin/2025-05-01
-
Reference - certbundde; cveprojectv5; nvd
https://source.android.com/docs/security/bulletin/2025-05-01
-
Reference - cveprojectv5; ncscclear
https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=03