Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Pixel ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszulösen.
Product
Das Android Betriebssystem von Google ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 118
-
Critical 9.8
In parseTrackFragmentRun() of MPEG4Extractor.cpp, there is a possible out of bounds read due to an integer overflow. Th…
-
Critical 9.8
In Pixel cellular firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to r…
-
Critical 9.8
In sms_SendMmCpErrMsg of sms_MmConManagement.c, there is a possible out of bounds write due to a heap buffer overflow. …
-
Critical 9.8
In ProfSixDecomTcpSACKoption of RohcPacketCommon, there is a possible out of bounds write due to a missing bounds check…
-
High 7.8
In parseParamsBlob of types.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead…
-
High 7.8
In removePermission of PermissionManagerServiceImpl.java, there is a possible way to obtain dangerous permissions witho…
-
High 7.8
In getAvailabilityStatus of EnableContentCapturePreferenceController.java, there is a possible way to bypass DISALLOW_C…
-
High 7.8
In multiple functions of SnoozeHelper.java, there is a possible failure to persist settings due to an uncaught exceptio…
-
High 7.8
In MediaCodec.cpp, there is a possible use after free due to improper locking. This could lead to local escalation of p…
-
High 7.8
In onContextItemSelected of NetworkProviderSettings.java, there is a possible way for users to change the Wi-Fi setting…
-
High 7.8
In getAvailabilityStatus of several Transcode Permission Controllers, there is a possible permission bypass due to a mi…
-
High 7.8
In getAvailabilityStatus of several Transcode Permission Controllers, there is a possible permission bypass due to a mi…
-
High 7.8
In getAvailabilityStatus of several Transcode Permission Controllers, there is a possible permission bypass due to a mi…
-
High 7.8
In getAvailabilityStatus of several Transcode Permission Controllers, there is a possible permission bypass due to a mi…
-
High 7.8
In getAvailabilityStatus of several Transcode Permission Controllers, there is a possible permission bypass due to a mi…
-
High 7.8
In InstallStart of InstallStart.java, there is a possible way to change the installer package name due to an improper i…
-
High 7.8
In isTargetSdkLessThanQOrPrivileged of WifiServiceImpl.java, there is a possible way for the guest user to change admin…
-
High 7.8
In BufferBlock of Suballocation.cpp, there is a possible out of bounds write due to memory corruption. This could lead …
-
High 7.8
In maybeFinish of FallbackHome.java, there is a possible delay of lockdown screen due to logic error. This could lead t…
-
High 7.8
In Confirmation of keystore_cli_v2.cpp, there is a possible way to corrupt memory due to a double free. This could lead…
-
High 7.8
In multiple functions of SensorService.cpp, there is a possible access of accurate sensor data due to a permissions byp…
-
High 7.8
In multiple functions of BackupHelper.java, there is a possible way for an app to get permissions previously granted to…
-
High 7.8
In buildCommand of bluetooth_ccc.cc, there is a possible out of bounds write due to a logic error in the code. This cou…
-
High 7.8
In append_to_params of param_util.c, there is a possible out of bounds write due to an incorrect bounds check. This cou…
-
High 7.5CVE-2022-40303 EPSS 41%
An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE pa…
-
High 7.5
In multiple functions of PasspointXmlUtils.java, there is a possible authentication misconfiguration due to a logic err…
-
High 7.5
In parse_printerAttributes of ipphelper.c, there is a possible out of bounds read due to a string without a null-termin…
-
High 7.5
In sms_ExtractCbLanguage of sms_CellBroadcast.c, there is a possible out of bounds read due to a missing bounds check. …
-
High 7.5CVE-2023-24033 EPSS 33%
The Samsung Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto T512 baseband modem chipsets…
-
High 7.3
In getConfirmationMessage of DefaultAutofillPicker.java, there is a possible way to mislead the user to select default …
-
High 7.2
In EUTRAN_LCS_ConvertLCS_MOLRReq of LPP_CommonUtil.c, there is a possible out of bounds write due to a logic error in t…
-
Medium 6.7
Memory corruption in camera due to buffer copy without checking size of input in Snapdragon Auto, Snapdragon Compute, S…
-
Medium 6.7
Use after free in WLAN
Memory corruption in WLAN due to use after free
-
Medium 6.7
In UnwindingWorker of unwinding.cc, there is a possible out of bounds write due to a use after free. This could lead to…
-
Medium 6.7
In registerSignalHandlers of main.c, there is a possible local arbitrary code execution due to a use after free. This c…
-
Medium 6.7
In cs40l2x_cp_trigger_queue_show of cs40l2x.c, there is a possible out of bounds write due to a use after free. This co…
-
Medium 6.7
In (TBD) of (TBD), there is a possible way to corrupt memory due to a use after free. This could lead to local escalati…
-
Medium 6.7
In (TBD) of (TBD), there is a possible way to corrupt memory due to a use after free. This could lead to local escalati…
-
Medium 6.7
In load_png_image of ExynosHWCHelper.cpp, there is a possible out of bounds write due to improper input validation. Thi…
-
Medium 6.7
In dwc3_exynos_clk_get of dwc3-exynos.c, there is a possible out of bounds write due to an incorrect bounds check. This…
-
Medium 6.7
In setToExternal of ril_external_client.cpp, there is a possible out of bounds write due to a missing bounds check. Thi…
-
Medium 6.7
In lwis_slc_buffer_free of lwis_device_slc.c, there is a possible memory corruption due to type confusion. This could l…
-
Medium 6.7
In rtt_unpack_xtlv_cbfn of dhd_rtt.c, there is a possible out of bounds write due to a heap buffer overflow. This could…
-
Medium 6.4
In dit_hal_ioctl of dit.c, there is a possible use after free due to a race condition. This could lead to local escalat…
-
Medium 5.9
Stack based buffer overflow in Core
Memory corruption due to stack based buffer overflow in core while sending command from USB of large size.
-
Medium 5.5
In btm_vendor_specific_evt of btm_devctl.cc, there is a possible out of bounds read due to a missing bounds check. This…
-
Medium 5.5
In btm_create_conn_cancel_complete of btm_sec.cc, there is a possible out of bounds read due to a missing bounds check.…
-
Medium 5.5
In btm_ble_add_resolving_list_entry_complete of btm_ble_privacy.cc, there is a possible out of bounds read due to a mis…
-
Medium 5.5
In GetNextSourceDataPacket of bta_av_co.cc, there is a possible out of bounds read due to a missing bounds check. This …
-
Medium 5.5
In multiple locations, there is a possible way to trigger a persistent reboot loop due to improper input validation. Th…
-
Medium 5.5
In multiple locations, there is a possible way to trigger a persistent reboot loop due to improper input validation. Th…
-
Medium 5.5
In multiple locations, there is a possible way to trigger a persistent reboot loop due to improper input validation. Th…
-
Medium 5.5
In multiple locations, there is a possible way to trigger a persistent reboot loop due to improper input validation. Th…
-
Medium 5.5
In AccountTypePreference of AccountTypePreference.java, there is a possible way to mislead the user about accounts inst…
-
Medium 5.5
In ih264e_init_proc_ctxt of ih264e_process.c, there is a possible out of bounds read due to a heap buffer overflow. Thi…
-
Medium 5.5
In updateInputChannel of WindowManagerService.java, there is a possible way to set a touchable region beyond its own Su…
-
Medium 5.5
In register of UidObserverController.java, there is a missing permission check. This could lead to local information di…
-
Medium 5.5
In addNetwork of WifiManager.java, there is a possible way to trigger a persistent DoS due to resource exhaustion. This…
-
Medium 5.5CVE-2023-21036 Public exploit
In BitmapExport.java, there is a possible failure to truncate images due to a logic error in the code.Product: AndroidV…
-
Medium 5.1
In multiple locations of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This coul…
-
Medium 4.7
In setPowerMode of HWC2.cpp, there is a possible out of bounds read due to a race condition. This could lead to local i…
-
Medium 4.5
In btm_read_rssi_complete of btm_acl.cc, there is a possible out of bounds read due to a missing bounds check. This cou…
-
Medium 4.4
In multiple functions of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This coul…
-
Medium 4.4
In multiple locations of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This coul…
-
Medium 4.4
In multiple locations of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This coul…
-
Medium 4.4
In btm_ble_read_remote_features_complete of btm_ble_gap.cc, there is a possible out of bounds read due to improper inpu…
-
Medium 4.4
In btm_ble_write_adv_enable_complete of btm_ble_gap.cc, there is a possible out of bounds read due to a missing bounds …
-
Medium 4.4
In multiple locations of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This coul…
-
Medium 4.4
In multiple locations of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This coul…
-
Medium 4.4
In multiple locations of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This coul…
-
Medium 4.4
In multiple locations of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This coul…
-
Medium 4.4
In multiple locations of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This coul…
-
Medium 4.4
In multiple locations of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This coul…
-
Medium 4.4
In forceStaDisconnection of hostapd.cpp, there is a possible out of bounds read due to a missing bounds check. This cou…
-
Medium 4.4
In ufdt_local_fixup_prop of ufdt_overlay.c, there is a possible out of bounds read due to an incorrect bounds check. Th…
-
Medium 4.4
In _ufdt_output_node_to_fdt of ufdt_convert.c, there is a possible out of bounds read due to a heap buffer overflow. Th…
-
Medium 4.4
In dumpstateBoard of Dumpstate.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could…
-
Medium 4.4
In init of VendorGraphicBufferMeta, there is a possible out of bounds read due to a missing bounds check. This could le…
-
Medium 4.4
When cpif handles probe failures, there is a possible out of bounds read due to a use after free. This could lead to lo…
-
Medium 4.4
In ConvertToHalMetadata of aidl_utils.cc, there is a possible out of bounds read due to an incorrect bounds check. This…
-
Medium 4.4
In ConvertToHalMetadata of aidl_utils.cc, there is a possible out of bounds read due to a missing bounds check. This co…
-
Medium 4.4
In handleEvent of nan.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to loc…
-
Medium 4.4
In append_camera_metadata of camera_metadata.c, there is a possible out of bounds read due to a missing bounds check. T…
-
Low 3.7
In multiple locations of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This coul…
-
Unscored —
In OEM_OnRequest of sced.cpp, there is a possible shell command execution due to improper input validation. This could …
-
Unscored —
In ffa_mrd_prot of shared_mem.c, there is a possible ID due to a logic error in the code. This could lead to local info…
-
Unscored —
In btu_ble_ll_conn_param_upd_evt of btu_hcif.cc, there is a possible out of bounds read due to a missing bounds check. …
-
Unscored —
In btu_ble_rc_param_req_evt of btu_hcif.cc, there is a possible out of bounds read due to a missing bounds check. This …
-
Unscored —
In btm_read_tx_power_complete of btm_acl.cc, there is a possible out of bounds read due to a missing bounds check. This…
-
Unscored —
In btm_ble_rand_enc_complete of btm_ble.cc, there is a possible out of bounds read due to a missing bounds check. This …
-
Unscored —
In ParseBqrLinkQualityEvt of btif_bqr.cc, there is a possible out of bounds read due to a missing bounds check. This co…
-
Unscored —
In BTA_GATTS_HandleValueIndication of bta_gatts_api.cc, there is a possible out of bounds write due to improper input v…
-
Unscored —
In btm_ble_clear_resolving_list_completecomplete of btm_ble_privacy.cc, there is a possible out of bounds read due to a…
-
Unscored —
In btm_read_link_quality_complete of btm_acl.cc, there is a possible out of bounds read due to a missing bounds check. …
-
Unscored —
In btm_ble_rand_enc_complete of btm_ble.cc, there is a possible out of bounds read due to a missing bounds check. This …
-
Unscored —
In btm_ble_process_periodic_adv_sync_lost_evt of ble_scanner_hci_interface.cc , there is a possible out of bounds read …
-
Unscored —
In on_iso_link_quality_read of btm_iso_impl.h, there is a possible out of bounds read due to a missing bounds check. Th…
-
Unscored —
In _ufdt_output_property_to_fdt of ufdt_convert.c, there is a possible out of bounds write due to an incorrect bounds c…
-
Unscored —
In captureImage of CustomizedSensor.cpp, there is a possible way to bypass the fingerprint unlock due to a logic error …
-
Unscored —
In lcsm_SendRrAcquiAssist of lcsm_bcm_assist.c, there is a possible out of bounds write due to a missing bounds check. …
-
Unscored —
In EUTRAN_LCS_DecodeFacilityInformationElement of LPP_LcsManagement.c, there is a possible out of bounds read due to a …
-
Unscored —
In sms_GetTpPiIe of sms_PduCodec.c, there is a possible out of bounds read due to a missing bounds check. This could le…
-
Unscored —
Product: AndroidVersions: Android kernelAndroid ID: A-229255400References: N/A
-
Unscored —
In DoSetTempEcc of imsservice.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could …
-
Unscored —
In ParseWithAuthType of simdata.cpp, there is a possible out of bounds read due to an incorrect bounds check. This coul…
-
Unscored —
In DoSetPinControl of miscservice.cpp, there is a possible out of bounds read due to a missing bounds check. This could…
-
Unscored —
In fdt_next_tag of fdt.c, there is a possible out of bounds write due to an integer overflow. This could lead to local …
-
Unscored —
Product: AndroidVersions: Android kernelAndroid ID: A-254114726References: N/A
-
Unscored —
In (TBD) of (TBD), there is a possible way to boot with a hidden debug policy due to a missing warning to the user. Thi…
-
Unscored —
In wl_update_hidden_ap_ie of wl_cfgscan.c, there is a possible out of bounds write due to a missing bounds check. This …
-
Unscored —
In add_roam_cache_list of wl_roam.c, there is a possible out of bounds write due to a missing bounds check. This could …
-
Unscored —
In dhd_prot_ioctcmplt_process of dhd_msgbuf.c, there is a possible out of bounds write due to improper input validation…
-
Unscored —
In rtt_unpack_xtlv_cbfn of dhd_rtt.c, there is a possible out of bounds write due to a buffer overflow. This could lead…
-
Unscored —
In rtt_unpack_xtlv_cbfn of dhd_rtt.c, there is a possible out of bounds write due to a buffer overflow. This could lead…
-
Unscored —
In get_svc_hash of nan.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to l…
-
Unscored —
In createTransmitFollowupRequest of nan.cpp, there is a possible out of bounds write due to a heap buffer overflow. Thi…
-
Unscored —
In rtt_unpack_xtlv_cbfn of dhd_rtt.c, there is a possible out of bounds write due to a buffer overflow. This could lead…
-
Unscored —
In rtt_unpack_xtlv_cbfn of dhd_rtt.c, there is a possible out of bounds write due to a buffer overflow. This could lead…
Revision history
-
#1
Initiale Fassung
References
-
Pixel Update Bulletin—March 2023 vom 2023-03-13
https://source.android.com/docs/security/bulletin/pixel/2023-03-01