Summary
Google heeft kwetsbaarheden verholpen in het Android besturingssysteem. Samsung heeft de voor Samsung Mobile relevante kwetsbaarheden verholpen in Samsung Mobile.
Details
Interpretaties
De kwetsbaarheden bevinden zich in de wijze waarop de GPU Kernel Drivers omgaan met systeemoproepen van niet-geprivilegieerde gebruikers. Dit kan leiden tot ongeautoriseerde toegang tot geheugen, geheugenmanipulatie en systeeminstabiliteit. Aangevallen systemen kunnen onvoorspelbaar gedrag vertonen of vastlopen, wat een significante impact heeft op de integriteit en vertrouwelijkheid van gegevens. De kwetsbaarheden zijn vooral zorgwekkend in omgevingen waar gebruikersprivileges niet strikt worden gehandhaafd.
Oplossingen
Google heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Samsung heeft updates uitgebracht om de voor Samsung Mobile relevante kwetsbaarheden te verhelpen.
Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 44
-
High 8.2
Buffer Over-read in Data Network Stack & Connectivity
Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources.
-
High 8.2
Buffer Over-read in Data Network Stack & Connectivity
Information disclosure may occur while decoding the RTP packet with invalid header extension from network.
-
High 8.2
Buffer Over-read in Data Network Stack & Connectivity
Information disclosure may occur while processing goodbye RTCP packet from network.
-
High 8.2
Buffer Over-read in Data Network Stack & Connectivity
Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call.
-
High 7.8
GPU DDK - Exploitable kernel double free on apsFenceSyncCheckpoints allocated with arbitrary size
Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory.
-
High 7.8
Improper Access Control in Core
Memory corruption may occur while attaching VM when the HLOS retains access to VM.
-
High 7.8
Mali GPU Kernel Driver allows improper GPU memory processing operations
Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to already freed memory.This i…
-
High 7.8
GPU DDK - PMMETA_PROTECT PMR can be exported as dma-buf file / GEM object
Software installed and run as a non-privileged user may conduct improper GPU system calls to issue reads and writes to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU drive…
-
High 7.8
Mali GPU Kernel Driver allows access to already freed memory
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to gain acces…
-
High 7.8
GPU DDK - _WrapExtMemReleasePages called twice if _FlushUMVirtualRange fails
Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory.
-
High 7.8
Use After Free in NPU
Memory corruption while calling the NPU driver APIs concurrently.
-
High 7.8
Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service
Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC.
-
High 7.8
Untrusted Pointer Dereference in DSP Service
Memory corruption during dynamic process creation call when client is only passing address and length of shell binary.
-
High 7.8
GPU DDK - PhysmemWrapExtMem uiSize=0 corrupts kernel memory
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause kernel system memory corruption.
-
High 7.8
In onInputEvent of IInputMethodSessionWrapper.java, there is a possible way for an untrusted app to inject key and moti…
-
High 7.8
In loadDrawableForCookie of ResourcesImpl.java, there is a possible way to access task snapshots of other apps due to a…
-
High 7.8
In multiple functions of NdkMediaCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This…
-
High 7.8
In multiple functions of LocationProviderManager.java, there is a possible background activity launch due to a logic er…
-
High 7.8
In AccessibilityServiceConnection.java, there is a possible background activity launch due to a logic error in the code…
-
High 7.8
In createIntentsList of PackageParser.java , there is a possible way to bypass lazy bundle hardening, allowing modified…
-
High 7.5
Buffer Over-read in WLAN HAL
Transient DOS while processing the tone measurement response buffer when the response buffer is out of range.
-
High 7.3CVE-2025-26443 Public exploit
In parseHtml of HtmlToSpannedParser.java, there is a possible way to install apps without allowing installation from un…
-
High 7.1
GPU DDK - ui64RobustnessAddress can overwrite Freelist / HWRT (and bypass PMMETA)
Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driv…
-
Medium 6.8
Incorrect default permission in Samsung Cloud for Galaxy Watch prior to SMR Jun-2025 Release 1 allows local attackers t…
-
Medium 6.5
GPU DDK - OOB read and write of the shared KMD/FW memory heap (VZ/TEE setups)
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to read and/or write data outside the Guest's virtualised GPU memory.
-
Medium 6.5
In add_attr of sdp_discovery.cc, there is a possible out of bounds read due to a missing bounds check. This could lead …
-
Medium 6.2
Improper access control in AudioService prior to SMR Jun-2025 Release 1 allows local attackers to access sensitive info…
-
Medium 5.5
GPU DDK - Untrusted app can crash firmware by forcing MCU access to non-aligned address
Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger a crash of the FW running on the GPU freezing graphics output.
-
Medium 5.5
Improper privilege management in ThemeManager prior to SMR Jun-2025 Release 1 allows local privileged attackers to reus…
-
Medium 5.5
Improper access control in ScreenCapture for Galaxy Watch prior to SMR Jun-2025 Release 1 allows local attackers to tak…
-
Medium 5.5
Out-of-bounds read in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to read ou…
-
Medium 5.5
In multiple locations, there is a possible way to persistently DoS the device due to a missing length check. This could…
-
Medium 5.5
In CredentialManagerServiceStub of CredentialManagerService.java, there is a possible way to retrieve candidate credent…
-
Medium 5.5
In offerNetwork of ConnectivityService.java, there is a possible leak of sensitive data due to a missing permission che…
-
Medium 5.5
In writeToParcel of CursorWindow.cpp, there is a possible out of bounds read due to uninitialized data. This could lead…
-
Medium 5.5
In multiple locations, there is a possible permanent denial of service due to resource exhaustion. This could lead to l…
-
Medium 5.5
In isContentUriForOtherUser of BluetoothOppSendFileInfo.java, there is a possible cross user data leak due to a logic e…
-
Medium 5.5
In multiple functions of DexUseManagerLocal.java, there is a possible way to crash system server due to a logic error i…
-
Medium 5.5
In allowPackageAccess of multiple files, resource exhaustion is possible when repeatedly adding allowed packages. This …
-
Medium 5.2
Improper access control in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to ge…
-
Medium 5.2
Improper logging in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to get a hma…
-
Medium 4.0
Improper export of Android application components in Bluetooth prior to SMR Jun-2025 Release 1 allows local attackers t…
-
Medium 4.0
Out-of-bound read in libsecimaging.camera.samsung.so prior to SMR Feb-2025 Release 1 allows local attackers to read out…
-
Medium 4.0
Out-of-bounds write in libsecimaging.camera.samsung.so prior to SMR Jun-2025 Release 1 allows local attackers to write …
Revision history
-
#1.0.0
Initiele versie
References
-
Reference - certbundde
https://source.android.com/docs/security/bulletin/2025-06-01
-
Reference - cveprojectv5; nvd
https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=06