Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erweitern, einen Denial-of-Service-Zustand zu verursachen und vertrauliche Informationen offenzulegen.
Product
Das Android Betriebssystem von Google ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 48
-
Critical 9.3
Non-secure region can try modifying RG permissions of IO space xPUs due to improper input validation in Snapdragon Auto…
-
High 8.4
Out of bound write in DSP service due to improper bound check for response buffer size in Snapdragon Auto, Snapdragon C…
-
High 8.4
Memory corruption in graphics due to buffer overflow while validating the user address in Snapdragon Auto, Snapdragon C…
-
High 8.4
Memory corruption in graphics due to use-after-free while importing graphics buffer in Snapdragon Auto, Snapdragon Comp…
-
High 7.8
In MMU_UnmapPages of the PowerVR kernel driver, there is a possible out of bounds write due to a missing bounds check. …
-
High 7.8
In _PMRLogicalOffsetToPhysicalOffset of the PowerVR kernel driver, there is a possible out of bounds write due to a mis…
-
High 7.8
In navigateUpTo of Task.java, there is a possible way to launch an unexported intent handler due to a logic error in th…
-
High 7.8
In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way to bypass user consent due to a…
-
High 7.8
In onCallRedirectionComplete of CallsManager.java, there is a possible permissions bypass due to a missing permission c…
-
High 7.8CVE-2022-20452 Public exploit
In initializeFromParcelLocked of BaseBundle.java, there is a possible method arbitrary code execution due to a confused…
-
High 7.8
In phNxpNciHal_write_unlocked of phNxpNciHal.cc, there is a possible out of bounds write due to a missing bounds check.…
-
High 7.8
In music service, there is a missing permission check. This could lead to elevation of privilege in contacts service wi…
-
High 7.8
In telephony, there is a possible permission bypass due to a parcel format mismatch. This could lead to local escalatio…
-
High 7.8
In soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts se…
-
High 7.8
In soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts se…
-
High 7.5
In process_service_search_rsp of sdp_discovery.cc, there is a possible out of bounds read due to improper input validat…
-
High 7.5
Denial of service in MODEM due to reachable assertion in Snapdragon Mobile
-
High 7.5
Denial of service in WLAN due to potential null pointer dereference while accessing the memory location in Snapdragon A…
-
High 7.5
Transient DOS due to buffer over-read in WLAN firmware while parsing cipher suite info attributes. in Snapdragon Comput…
-
High 7.5
Transient DOS due to buffer over-read in WLAN firmware while processing PPE threshold. in Snapdragon Auto, Snapdragon C…
-
High 7.5
Transient DOS due to loop with unreachable exit condition in WLAN firmware while parsing IPV6 extension header. in Snap…
-
High 7.3
Memory corruption in video due to configuration weakness. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivi…
-
Medium 6.8
Improper checking of AP-S lock bit while verifying the secure resource group permissions can lead to non secure read an…
-
Medium 6.8
Possible address manipulation from APP-NS while APP-S is configuring an RG where it tries to merge the address ranges i…
-
Medium 6.8
Information disclosure in video due to buffer over-read while parsing avi files in Snapdragon Auto, Snapdragon Compute,…
-
Medium 6.7
In fdt_next_tag of fdt.c, there is a possible out of bounds write due to an integer overflow. This could lead to local …
-
Medium 6.7
In (TBD) of (TBD), there is a possible way to redirect code execution due to improper input validation. This could lead…
-
Medium 6.7
In (TBD) mprot_unmap? of (TBD), there is a possible way to corrupt the memory mapping due to improper input validation.…
-
Medium 6.5
In PAN_WriteBuf of pan_api.cc, there is a possible out of bounds read due to a use after free. This could lead to remot…
-
Medium 6.5
Cryptographic issues in WLAN during the group key handshake of the WPA/WPA2 protocol in Snapdragon Consumer IOT, Snapdr…
-
Medium 6.2
A null pointer dereference may potentially occur during RSA key import in Snapdragon Auto, Snapdragon Compute, Snapdrag…
-
Medium 6.2
Denial of service in video due to improper access control in broadcast receivers in Snapdragon Compute, Snapdragon Cons…
-
Medium 5.5
In setImpl of AlarmManagerService.java, there is a possible way to put a device into a boot loop due to an uncaught exc…
-
Medium 5.5
In multiple functions of many files, there is a possible obstruction of the user's ability to select a phone account du…
-
Medium 5.5
In buzzBeepBlinkLocked of NotificationManagerService.java, there is a possible way to share data across users due to a …
-
Medium 5.5
In update of MmsProvider.java, there is a possible constriction of directory permissions due to a path traversal error.…
-
Medium 5.5
In getMountModeInternal of StorageManagerService.java, there is a possible prevention of package installation due to im…
-
Medium 5.5
In jpg driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial o…
-
Medium 5.5
In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local informati…
-
Medium 5.5
In face detect driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local …
-
Medium 5.5
In face detect driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local …
-
Medium 5.5
In gpu driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial o…
-
Medium 5.5
In camera driver, there is a possible memory corruption due to improper locking. This could lead to local denial of ser…
-
Medium 5.5
In sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denia…
-
Medium 4.6
In dismiss and related functions of KeyguardHostViewController.java and related files, there is a possible lockscreen b…
-
Low 3.3
In AlwaysOnHotwordDetector of AlwaysOnHotwordDetector.java, there is a possible way to access the microphone from the b…
-
Unscored —CVE-2022-20463 Rejected
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigat…
-
Unscored —CVE-2022-2209 Rejected
DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and…
Revision history
-
#2
Exploit für CVE-2022-20452 aufgenommen
-
#1
Initiale Fassung
References
-
Exploit CVE-2022-20452 vom 2023-02-02
https://github.com/michalbednarski/LeakValue
-
Android Security Bulletin November 2022 vom 2022-11-07
https://source.android.com/docs/security/bulletin/2022-11-01
-
Pixel Update Bulletin November 2022 vom 2022-11-07
https://source.android.com/docs/security/bulletin/pixel/2022-11-01