Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen, vertrauliche Informationen offenzulegen, Code auszuführen und einen Denial-of-Service-Zustand zu verursachen.
Product
Das Android Betriebssystem von Google ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 55
-
High 7.8
In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional…
KEV Apr 13, 2023 -
Critical 9.8
Improper validation of array index in Multi-mode call processor
Memory corruption due to improper validation of array index in Multi-mode call processor.
-
Critical 9.8
In gatt_process_prep_write_rsp of gatt_cl.cc, there is a possible out of bounds write due to a missing bounds check. Th…
-
Critical 9.8
In SDP_AddAttribute of sdp_db.cc, there is a possible out of bounds write due to an incorrect bounds check. This could …
-
High 8.4
Buffer copy without checking the size of input in WLAN HAL.
Memory corruption in WLAN HAL while arbitrary value is passed in WMI UTF command payload.
-
High 8.4
Use of Out-of-range Pointer Offset in MODEM
Memory corruption in Modem due to usage of Out-of-range pointer offset in UIM
-
High 8.4
Use of Out-of-range Pointer Offset in Data Modem
Memory corruption in modem due to use of out of range pointer offset while processing qmi msg
-
High 8.4
Integer overflow to buffer overflow in WLAN
Memory corruption in WLAN due to integer overflow to buffer overflow in WLAN during initialization phase.
-
High 8.4
Incorrect type conversion in WLAN
Memory corruption in WLAN due to incorrect type cast while sending WMI_SCAN_SCH_PRIO_TBL_CMDID message.
-
High 8.4
Buffer copy without checking the size of input in Linux Kernel
Memory corruption due to buffer copy without checking the size of input while loading firmware in Linux Kernel.
-
High 7.8
Integer Overflow to Buffer Overflow in Modem
Memory corruption in modem due to integer overflow to buffer overflow while handling APDU response
-
High 7.8
Improper authentication in Qualcomm IPC
Memory corruption due to improper authentication in Qualcomm IPC while loading unsigned lib in audio PD.
-
High 7.8
Buffer copy without checking the size of input in HLOS
Memory corruption due to buffer copy without checking the size of input in HLOS when input message size is larger than the buffer capacity.
-
High 7.8
In onPackageAddedInternal of PermissionManagerService.java, there is a possible way to silently grant a permission afte…
-
High 7.8CVE-2023-20911 Public exploit
In addPermission of PermissionManagerServiceImpl.java , there is a possible failure to persist permission settings due …
-
High 7.8
In onTargetSelected of ResolverActivity.java, there is a possible way to share a wrong file due to a logic error in the…
-
High 7.8
In avdt_scb_hdl_write_req of avdt_scb_act.cc, there is a possible out of bounds write due to a heap buffer overflow. Th…
-
High 7.8
In bta_av_rc_disc_done of bta_av_act.cc, there is a possible out of bounds write due to a missing bounds check. This co…
-
High 7.8
In getGroupState of GrantPermissionsViewModel.kt, there is a possible way to keep a one-time permission granted due to …
-
High 7.8
In onPrimaryClipChanged of ClipboardListener.java, there is a possible way to bypass factory reset protection due to in…
-
High 7.8CVE-2023-20955 Public exploit
In onPrepareOptionsMenu of AppInfoDashboardFragment.java, there is a possible way to bypass admin restrictions and unin…
-
High 7.8
In onAttach of SettingsPreferenceFragment.java, there is a possible bypass of Factory Reset Protections due to a confus…
-
High 7.8
In AddSupervisedUserActivity, guest users are not prevented from starting the activity due to missing permissions check…
-
High 7.8
In launchDeepLinkIntentToRight of SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities…
-
High 7.8
In multiple functions of MediaSessionRecord.java, there is a possible Intent rebroadcast due to a confused deputy. This…
-
High 7.8
In inflate of inflate.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to loca…
-
High 7.5
Memory Corruption in MODEM
Memory corruption in modem due to buffer overflow while processing a PPP packet
-
High 7.5
Reachable assertion in Modem
Transient DOS due to reachable assertion in modem during MIB reception and SIB timeout
-
High 7.5
Reachable assertion in Modem
Transient DOS due to reachable assertion in modem when network repeatedly sent invalid message container for NR to LTE handover.
-
High 7.5
Reachable assertion in Modem
Transient DOS due to reachable assertion in Modem while processing SIB1 Message.
-
High 7.5
Reachable assertion in Modem
Transient DOS in modem due to reachable assertion.
-
High 7.5
Buiffer over-read in WLAN Firmware.
Transient DOS due to buffer over-read in WLAN Firmware while parsing secure FTMR frame with size lesser than 39 Bytes.
-
High 7.5
Reachable Assertion in WLAN Embedded SW
Transient DOS due to reachable assertion in WLAN while processing PEER ID populated by TQM.
-
High 7.5
Buffer Over-read in WLAN
Transient DOS due to buffer over-read in WLAN while sending a packet to device.
-
High 7.3
Double free in Video
Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms.
-
High 7.3
Improper Validation of Array Index in Bluetooth HOST
Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response.
-
High 7.1
In read_paint of ttcolr.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to loc…
-
Medium 6.8
In onParentVisible of HeaderPrivacyIconsController.kt, there is a possible way to bypass factory reset protections due …
-
Medium 6.4
In ion, there is a possible escalation of privilege due to improper locking. This could lead to local escalation of pri…
-
Medium 6.2
Information Exposure in Graphics
Information Disclosure in Graphics during GPU context switch.
-
Medium 5.5
In isBluetoothShareUri of BluetoothOppUtility.java, there is a possible incorrect file read due to a confused deputy. T…
-
Medium 5.5
In validateForCommonR1andR2 of PasspointConfiguration.java, uncaught errors in parsing stored configs could lead to loc…
-
Medium 5.5
In add of WifiNetworkSuggestionsManager.java, there is a possible way to trigger permanent DoS due to resource exhausti…
-
Medium 5.5
In sendHalfSheetCancelBroadcast of HalfSheetActivity.java, there is a possible way to learn nearby BT MAC addresses due…
-
Medium 5.5
In A2DP_BuildCodecHeaderSbc of a2dp_sbc.cc, there is a possible out of bounds write due to a missing bounds check. This…
-
Medium 5.5
In getSliceEndItem of MediaVolumePreferenceController.java, there is a possible way to start foreground activity from t…
-
Medium 4.4
In Import of C2SurfaceSyncObj.cpp, there is a possible out of bounds write due to a missing bounds check. This could le…
-
Unscored —
When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds.
-
Unscored —
Insufficient data validation in crosvm in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially…
-
Unscored —
In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
-
Unscored —
In gpu device, there is a memory corruption due to a use after free. This could lead to local denial of service in kern…
-
Unscored —
In telephone service, there is a missing permission check. This could lead to local escalation of privilege with system…
-
Unscored —
In telephone service, there is a missing permission check. This could lead to local escalation of privilege with system…
-
Unscored —
In adsp, there is a possible escalation of privilege due to a logic error. This could lead to local escalation of privi…
-
Unscored —
In tinysys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation …
Revision history
-
#3
Korrektur Produktzuordnung Samsung
-
#2
Aktive Ausnutzung gemeldet
-
#1
Initiale Fassung
References
-
Artikel auf arstechnica.com vom 2023-03-27
https://arstechnica.com/information-technology/2023/03/android-app-from-china-executed-0-day-exploit-on-millions-of-devices/
-
Android Security Bulletin vom 2023-03-06
https://source.android.com/docs/security/bulletin/2023-03-01