Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen, vertrauliche Informationen offenzulegen, Code auszuführen und einen Denial-of-Service-Zustand zu verursachen.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 66
-
High 8.8
The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are misha…
KEV Mar 30, 2023 -
Critical 9.8
In OnWakelockReleased of attribution_processor.cc, there is a use after free that could lead to remote code execution w…
-
Critical 9.3
Double free in Core
Memory corruption due to double free in core while initializing the encryption key.
-
Critical 9.3
Integer overflow or wraparound in Core
Memory corruption due to integer overflow or wraparound in Core while DDR memory assignment.
-
Critical 9.3
Buffer copy without checking the size of input in Core
Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information.
-
High 8.8
An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing opera…
-
High 8.8
An issue was discovered in the Arm Mali GPU Kernel Driver. There is a use-after-free. A non-privileged user can make im…
-
High 8.8
In nci_snd_set_routing_cmd of nci_hmsgs.cc, there is a possible out of bounds write due to a missing bounds check. This…
-
High 8.4
Integer overflow or wraparound in WLAN
Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.
-
High 8.4
Integer Overflow in Multimedia Framework
Memory Corruption in Multimedia Framework due to integer overflow when synx bind is called along with synx signal.
-
High 8.2
Buffer over-read in Bluetooth Host.
Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming.
-
High 7.8
In PVRSRVBridgeRGXKickVRDM of the PowerVR kernel driver, a missing size check means there is a possible integer overflo…
-
High 7.8
In PVRSRVBridgeRGXKickRS of the PowerVR kernel driver, a missing size check means there is a possible integer overflow …
-
High 7.8
In PVRSRVBridgeDevicememHistorySparseChange of the PowerVR kernel driver, a missing size check means there is a possibl…
-
High 7.8
In PVRSRVBridgeChangeSparseMem of the PowerVR kernel driver, a missing size check means there is a possible integer ove…
-
High 7.8
In PVRSRVBridgePhysmemNewRamBackedLockedPMR of the PowerVR kernel driver, a missing size check means there is a possibl…
-
High 7.8
In PVRSRVBridgeServerSyncGetStatus of the PowerVR kernel driver, a missing size check means there is a possible integer…
-
High 7.8
In PVRSRVBridgeRGXTDMSubmitTransfer of the PowerVR kernel driver, a missing size check means there is a possible intege…
-
High 7.8
In PVRSRVBridgeRGXKickTA3D of the PowerVR kernel driver, a missing size check means there is a possible integer overflo…
-
High 7.8
In PVRSRVBridgeRGXKickCDM of the PowerVR kernel driver, a missing size check means there is a possible integer overflow…
-
High 7.8
In PVRSRVBridgeRGXKickSync of the PowerVR kernel driver, a missing size check means there is a possible integer overflo…
-
High 7.8
In PVRSRVBridgeCacheOpQueue of the PowerVR kernel driver, a missing size check means there is a possible integer overfl…
-
High 7.8
In PVRSRVBridgePhysmemImportSparseDmaBuf of the PowerVR kernel driver, a missing size check means there is a possible i…
-
High 7.8
In PVRSRVBridgeSyncPrimOpTake of the PowerVR kernel driver, a missing size check means there is a possible integer over…
-
High 7.8
There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If…
-
High 7.8
In mmsdk, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local code ex…
-
High 7.8
In AlarmManagerActivity of AlarmManagerActivity.java, there is a possible way to bypass background activity launch rest…
-
High 7.8
In avdt_scb_hdl_pkt_no_frag of avdt_scb_act.cc, there is a possible out of bounds write due to an incorrect bounds chec…
-
High 7.8
In multiple functions of PackageInstallerService.java and related files, there is a possible way to bypass background a…
-
High 7.8
In onNullBinding of CallScreeningServiceHelper.java, there is a possible way to record audio without showing a privacy …
-
High 7.8CVE-2023-21086 Public exploit
In isToggleable of SecureNfcEnabler.java and SecureNfcPreferenceController.java, there is a possible way to enable NFC …
-
High 7.8
In deliverOnFlushComplete of LocationProviderManager.java, there is a possible way to bypass background activity launch…
-
High 7.8
In startInstrumentation of ActivityManagerService.java, there is a possible way to keep the foreground service alive wh…
-
High 7.8
In retrieveServiceLocked of ActiveServices.java, there is a possible way to dynamically register a BroadcastReceiver us…
-
High 7.8
In extractRelativePath of FileUtils.java, there is a possible way to access files in a directory belonging to other app…
-
High 7.8CVE-2023-21094 Public exploit
In sanitize of LayerState.cpp, there is a possible way to take over the screen display and swap the display content due…
-
High 7.8CVE-2023-21097 Public exploit
In toUriInner of Intent.java, there is a possible way to launch an arbitrary activity due to a confused deputy. This co…
-
High 7.8
In multiple functions of AccountManagerService.java, there is a possible loading of arbitrary code into the System Sett…
-
High 7.8
In multiple methods of PackageInstallerSession.java, there is a possible way to start foreground services from the back…
-
High 7.8
In inflate of inflate.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to loca…
-
High 7.5
Time-of-check time-of-use race condition in Modem
Transient DOS due to time-of-check time-of-use race condition in Modem while processing RRC Reconfiguration message.
-
High 7.1
In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
-
Medium 6.8
Improper validation of array index in Modem
Memory corruption occurs in Modem due to improper validation of array index when malformed APDU is sent from card.
-
Medium 6.8
Improper validation of array index in User Identity Module
Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length.
-
Medium 6.7
In rpmb, there is a possible out of bounds write due to a logic error. This could lead to local escalation of privilege…
-
Medium 6.7
In keyinstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalati…
-
Medium 6.7
In keyinstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalati…
-
Medium 6.7
In keyinstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalati…
-
Medium 6.7
In geniezone, there is a possible out of bounds write due to a logic error. This could lead to local escalation of priv…
-
Medium 6.7
In mtee, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of …
-
Medium 6.7
In buildPropFile of filesystem.go, there is a possible insecure hash due to an improperly used crypto. This could lead …
-
Medium 6.6
In acc_ctrlrequest_composite of f_accessory.c, there is a possible out of bounds write due to a missing bounds check. T…
-
Medium 5.5
In SendIncDecRestoreCmdPart2 of NxpMfcReader.cc, there is a possible out of bounds read due to a missing bounds check. …
-
Medium 5.5
In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
-
Medium 5.5
In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
-
Medium 5.5
In media service, there is a missing permission check. This could lead to local denial of service in media service.
-
Medium 5.5CVE-2023-20909 Public exploit
In multiple functions of RunningTasks.java, there is a possible privilege escalation due to a missing privilege check. …
-
Medium 5.5
In deserialize of multiple files, there is a possible out of bounds read due to a missing bounds check. This could lead…
-
Medium 5.5
In register_notification_rsp of btif_rc.cc, there is a possible out of bounds read due to a missing bounds check. This …
-
Medium 5.5
In getNumberFromCallIntent of NewOutgoingCallIntentBroadcaster.java, there is a possible way to enumerate other user's …
-
Medium 5.5
In PreferencesHelper.java, an uncaught exception may cause the device to get stuck in a boot loop. This could lead to l…
-
Medium 5.5
In canDisplayLocalUi of AppLocalePickerActivity.java, there is a possible way to change system app locales due to a mis…
-
Medium 5.0
In parseUsesPermission of ParsingPackageUtils.java, there is a possible boot loop due to resource exhaustion. This coul…
-
Unscored —CVE-2022-20463 Rejected
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigat…
-
Unscored —
An issue was discovered in the Arm Mali GPU Kernel Driver (Valhall r29p0 through r38p0). A non-privileged user can make…
-
Unscored —
An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing opera…
Revision history
-
#1
Initiale Fassung
References
-
Android Patchday April 2023 vom 2023-04-03
https://source.android.com/docs/security/bulletin/2023-04-01