Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erweitern, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und beliebigen Code auszuführen.
Product
Das Android Betriebssystem von Google ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 77
-
High 7.8
An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This…
KEV Aug 26, 2026 -
High 8.6
Use after Free in tc_new_tfilter allowing for privilege escalation in Linux Kernel
A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5
-
High 8.4
Memory corruption due to out of bound read while parsing a video file in Snapdragon Auto, Snapdragon Compute, Snapdrago…
-
High 8.4
Improper validation of backend id in PCM routing process can lead to memory corruption in Snapdragon Auto, Snapdragon C…
-
High 8.2
An out-of-bounds read can occur while parsing a server certificate due to improper length check in Snapdragon Auto, Sna…
-
High 7.8
Possible out of bound access due to improper validation of function table entries in Snapdragon Auto, Snapdragon Comput…
-
High 7.8
Out of bounds writing is possible while verifying device IDs due to improper length check before copying the data in Sn…
-
High 7.8
Memory corruption in audio due to lack of check of invalid routing address into APR Routing table in Snapdragon Auto, S…
-
High 7.8CVE-2022-29581 Public exploit
Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege …
-
High 7.7
Devices with keyprotect off may store unencrypted keybox in RPMB and cause cryptographic issue in Snapdragon Auto, Snap…
-
High 7.5
In updateAudioTrackInfoFromESDS_MPEG4Audio of MPEG4Extractor.cpp, there is a possible out of bounds read due to an inco…
-
High 7.5
In onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due to a confused deputy. T…
-
High 7.5
Potential memory leak in modem during the processing of NSA RRC Reconfiguration with invalid Radio Bearer Config in Sna…
-
High 7.3
In exynos5_i2c_irq of (TBD), there is a possible out of bounds write due to a use after free. This could lead to local …
-
High 7.3
Memory corruption in video driver due to double free while parsing ASF clip in Snapdragon Auto, Snapdragon Compute, Sna…
-
High 7.1
In startSync of AbstractThreadedSyncAdapter.java, there is a possible way to access protected content of content provid…
-
Medium 6.7
Use after free in the synx driver issue while performing other functions during multiple invocation of synx release cal…
-
Medium 6.7
In bdi_put and bdi_unregister of backing-dev.c, there is a possible memory corruption due to a use after free. This cou…
-
Medium 6.5
In l2cble_process_sig_cmd of l2c_ble.cc, there is a possible out of bounds write due to a missing bounds check. This co…
-
Medium 6.5CVE-2022-20361 Public exploit
In btif_dm_auth_cmpl_evt of btif_dm.cc, there is a possible vulnerability in Cross-Transport Key Derivation due to Weak…
-
Medium 6.2
In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way to trick the victim to grant notifi…
-
Medium 6.2CVE-2022-20360 Public exploit
In setChecked of SecureNfcPreferenceController.java, there is a missing permission check. This could lead to local esca…
-
Medium 4.2
remap_pfn_range' here may map out of size kernel memory (for example, may map the kernel area), and because the 'vma->v…
-
Medium 4.0
In shouldAllowFgsWhileInUsePermissionLocked of ActiveServices.java, there is a possible way to start foreground service…
-
Unscored —
In PVRSRVBridgeHeapCfgHeapDetails, there is a possible leak of kernel heap content due to uninitialized data. This coul…
-
Unscored —
In PVRSRVBridgeHeapCfgHeapConfigName, there is a possible leak of kernel heap content due to uninitialized data. This c…
-
Unscored —
An unprivileged app can trigger PowerVR driver to return an uninitialized heap memory causing information disclosure.Pr…
-
Unscored —
The method PVRSRVBridgePMRPDumpSymbolicAddr allocates puiMemspaceNameInt on the heap, fills the contents of the buffer …
-
Unscored —
The method PVRSRVBridgeTLDiscoverStreams allocates puiStreamsInt on the heap, fills the contents of the buffer via TLSe…
-
Unscored —
.A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in th…
-
Unscored —CVE-2021-39696 Public exploit
In Task.java, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation…
-
Unscored —
In ion_buffer_kmap_get of ion.c, there is a possible use-after-free due to an integer overflow. This could lead to loca…
-
Unscored —
The PowerVR GPU driver allows unprivileged apps to allocated pinned memory, unpin it (which makes it available to be fr…
-
Unscored —
A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with…
-
Unscored —CVE-2022-1011 Public exploit
A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw all…
-
Unscored —
A use-after-free flaw was found in the Linux kernel’s io_uring subsystem in the way a user sets up a ring with IORING_S…
-
Unscored —
In GPU, there is a possible use after free due to a race condition. This could lead to local escalation of privilege wi…
-
Unscored —
The PowerVR GPU driver allows unprivileged apps to allocated pinned memory, unpin it (which makes it available to be fr…
-
Unscored —
In several functions of mali_gralloc_reference.cpp, there is a possible arbitrary code execution due to a missing bound…
-
Unscored —
In BuildDevIDResponse of miscdatabuilder.cpp, there is a possible out of bounds write due to a missing bounds check. Th…
-
Unscored —
In stealReceiveChannel of EventThread.cpp, there is a possible way to interfere with process communication due to a rac…
-
Unscored —
In updateState of LocationServicesWifiScanningPreferenceController.java, there is a possible admin restriction bypass d…
-
Unscored —
In WifiScanningPreferenceController and BluetoothScanningPreferenceController, there is a possible admin restriction by…
-
Unscored —
In addProviderRequestListener of LocationManagerService.java, there is a possible way to learn which packages request l…
-
Unscored —
In onSaveRingtone of DefaultRingtonePreference.java, there is a possible inappropriate file read due to improper input …
-
Unscored —
In onDefaultNetworkChanged of Vpn.java, there is a possible way to disable VPN due to a logic error in the code. This c…
-
Unscored —
In get of PacProxyService.java, there is a possible system service crash due to improper input validation. This could l…
-
Unscored —
In writeToParcel of SurfaceControl.cpp, there is a possible information disclosure due to uninitialized data. This coul…
-
Unscored —
Product: AndroidVersions: Android kernelAndroid ID: A-229632566References: N/A
-
Unscored —
In ioctl_dpm_clk_update of lwis_ioctl.c, there is a possible out of bounds write due to an integer overflow. This could…
-
Unscored —
In construct_transaction of lwis_ioctl.c, there is a possible out of bounds write due to an integer overflow. This coul…
-
Unscored —
Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel
-
Unscored —
In v4l2_m2m_querybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input validation. This …
-
Unscored —
Product: AndroidVersions: Android kernelAndroid ID: A-215730643References: N/A
-
Unscored —
In dm_bow_dtr and related functions of dm-bow.c, there is a possible use after free due to a race condition. This could…
-
Unscored —
In st21nfc_loc_set_polaritymode of fc/st21nfc.c, there is a possible use after free due to a race condition. This could…
-
Unscored —CVE-2022-20374 Rejected
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigat…
-
Unscored —
In LteRrcNrProAsnDecode of LteRrcNr_Codec.c, there is a possible out of bounds read due to a missing bounds check. This…
-
Unscored —
In trusty_log_seq_start of trusty-log.c, there is a possible use after free due to improper locking. This could lead to…
-
Unscored —
In TBD of keymaster_ipc.cpp, there is a possible to force gatekeeper, fingerprint, and faceauth to use a known HMAC key…
-
Unscored —
Product: AndroidVersions: Android kernelAndroid ID: A-234657153References: N/A
-
Unscored —
In lwis_buffer_alloc of lwis_buffer.c, there is a possible arbitrary code execution due to a use after free. This could…
-
Unscored —
Product: AndroidVersions: Android kernelAndroid ID: A-212625740References: N/A
-
Unscored —
Product: AndroidVersions: Android kernelAndroid ID: A-188935887References: N/A
-
Unscored —
In (TBD) of (TBD), there is a possible out of bounds write due to kernel stack overflow. This could lead to local escal…
-
Unscored —
In AllocateInternalBuffers of g3aa_buffer_allocator.cc, there is a possible out of bounds write due to an integer overf…
-
Unscored —
Product: AndroidVersions: Android kernelAndroid ID: A-211727306References: N/A
-
Unscored —
In cd_CodeMsg of cd_codec.c, there is a possible out of bounds write due to a missing bounds check. This could lead to …
-
Unscored —
In SAEMM_RetrievEPLMNList of SAEMM_ContextManagement.c, there is a possible out of bounds read due to a missing bounds …
-
Unscored —
Product: AndroidVersions: Android kernelAndroid ID: A-218701042References: N/A
-
Unscored —
Product: AndroidVersions: Android kernelAndroid ID: A-207975764References: N/A
-
Unscored —
Product: AndroidVersions: Android kernelAndroid ID: A-205714161References: N/A
-
Unscored —
Product: AndroidVersions: Android kernelAndroid ID: A-216363416References: N/A
-
Unscored —
Product: AndroidVersions: Android kernelAndroid ID: A-184676385References: N/A
-
Unscored —
Product: AndroidVersions: Android kernelAndroid ID: A-210916981References: N/A
-
Unscored —
Product: AndroidVersions: Android kernelAndroid ID: A-204782372References: N/A
-
Unscored —CVE-2022-27666 Public exploit
A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This fla…
Revision history
-
#9
Neue Updates von SUSE aufgenommen
-
#8
Neue Updates von Red Hat aufgenommen
-
#7
Neue Updates von Ubuntu aufgenommen
-
#6
Neue Updates von ORACLE aufgenommen
-
#5
Neue Updates von Red Hat aufgenommen
-
#4
Neue Updates von Ubuntu aufgenommen
-
#3
Neue Updates von Amazon aufgenommen
-
#2
CVE's ergänzt
-
#1
Initiale Fassung
References
-
Android-Sicherheitsbulletin - August 2022 vom 2022-08-02
https://source.android.com/security/bulletin/2022-08-01
-
Pixel Update Bulletin - Juli 2022 vom 2022-08-02
https://source.android.com/security/bulletin/pixel/2022-08-01
-
Amazon Linux Security Advisory ALAS2KERNEL-5.4-2022-036 vom 2022-10-14
https://alas.aws.amazon.com/AL2/ALASKERNEL-5.4-2022-036.html
-
Ubuntu Security Notice USN-5682-1 vom 2022-10-14
https://ubuntu.com/security/notices/USN-5682-1
-
Red Hat Security Advisory RHSA-2022:8267 vom 2022-11-15
https://access.redhat.com/errata/RHSA-2022:8267
-
ORACLE OVMSA-2022-0031 vom 2022-12-08
https://oss.oracle.com/pipermail/oraclevm-errata/2022-December/001064.html
-
Ubuntu Security Notice USN-5854-1 vom 2023-02-09
https://ubuntu.com/security/notices/USN-5854-1
-
Red Hat Security Advisory RHSA-2024:0930 vom 2024-02-21
https://access.redhat.com/errata/RHSA-2024:0930
-
SUSE Security Update SUSE-SU-2024:3467-1 vom 2024-09-27
https://lists.suse.com/pipermail/sle-security-updates/2024-September/019532.html