Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Samsung Android und Samsung Exynos ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.
Product
Exynos ist der Markenname für Samsung-Mobilfunk-Chipsätze und Prozessoren.
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 71
-
Critical 9.8
Improper validation of array index in Multi-mode call processor
Memory corruption due to improper validation of array index in Multi-mode call processor.
-
Critical 9.8
In OnWakelockReleased of attribution_processor.cc, there is a use after free that could lead to remote code execution w…
-
High 8.8
In nci_snd_set_routing_cmd of nci_hmsgs.cc, there is a possible out of bounds write due to a missing bounds check. This…
-
High 8.5
Improper input validation vulnerability in CertByte prior to SMR Apr-2023 Release 1 allows local attackers to launch pr…
-
High 8.4
Buffer copy without checking the size of input in WLAN HAL.
Memory corruption in WLAN HAL while arbitrary value is passed in WMI UTF command payload.
-
High 8.4
Use of Out-of-range Pointer Offset in MODEM
Memory corruption in Modem due to usage of Out-of-range pointer offset in UIM
-
High 8.4
Use of Out-of-range Pointer Offset in Data Modem
Memory corruption in modem due to use of out of range pointer offset while processing qmi msg
-
High 8.4
Integer overflow to buffer overflow in WLAN
Memory corruption in WLAN due to integer overflow to buffer overflow in WLAN during initialization phase.
-
High 8.4
Incorrect type conversion in WLAN
Memory corruption in WLAN due to incorrect type cast while sending WMI_SCAN_SCH_PRIO_TBL_CMDID message.
-
High 8.4
Buffer copy without checking the size of input in Linux Kernel
Memory corruption due to buffer copy without checking the size of input while loading firmware in Linux Kernel.
-
High 8.0
Out-of-bounds Write vulnerability in libaudiosaplus_sec.so library prior to SMR Apr-2023 Release 1 allows local attacke…
-
High 8.0
Out-of-bounds Write vulnerability in libaudiosaplus_sec.so library prior to SMR Apr-2023 Release 1 allows local attacke…
-
High 7.9
Access of Memory Location After End of Buffer vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows l…
-
High 7.8
Integer Overflow to Buffer Overflow in Modem
Memory corruption in modem due to integer overflow to buffer overflow while handling APDU response
-
High 7.8
Improper authentication in Qualcomm IPC
Memory corruption due to improper authentication in Qualcomm IPC while loading unsigned lib in audio PD.
-
High 7.8
Buffer copy without checking the size of input in HLOS
Memory corruption due to buffer copy without checking the size of input in HLOS when input message size is larger than the buffer capacity.
-
High 7.8
In AlarmManagerActivity of AlarmManagerActivity.java, there is a possible way to bypass background activity launch rest…
-
High 7.8
In avdt_scb_hdl_pkt_no_frag of avdt_scb_act.cc, there is a possible out of bounds write due to an incorrect bounds chec…
-
High 7.8
In multiple functions of PackageInstallerService.java and related files, there is a possible way to bypass background a…
-
High 7.8
In onNullBinding of CallScreeningServiceHelper.java, there is a possible way to record audio without showing a privacy …
-
High 7.8CVE-2023-21086 Public exploit
In isToggleable of SecureNfcEnabler.java and SecureNfcPreferenceController.java, there is a possible way to enable NFC …
-
High 7.8
In deliverOnFlushComplete of LocationProviderManager.java, there is a possible way to bypass background activity launch…
-
High 7.8
In startInstrumentation of ActivityManagerService.java, there is a possible way to keep the foreground service alive wh…
-
High 7.8
In retrieveServiceLocked of ActiveServices.java, there is a possible way to dynamically register a BroadcastReceiver us…
-
High 7.8
In extractRelativePath of FileUtils.java, there is a possible way to access files in a directory belonging to other app…
-
High 7.8CVE-2023-21094 Public exploit
In sanitize of LayerState.cpp, there is a possible way to take over the screen display and swap the display content due…
-
High 7.8CVE-2023-21097 Public exploit
In toUriInner of Intent.java, there is a possible way to launch an arbitrary activity due to a confused deputy. This co…
-
High 7.8
In multiple functions of AccountManagerService.java, there is a possible loading of arbitrary code into the System Sett…
-
High 7.8
In multiple methods of PackageInstallerSession.java, there is a possible way to start foreground services from the back…
-
High 7.8
In inflate of inflate.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to loca…
-
High 7.5
Memory Corruption in MODEM
Memory corruption in modem due to buffer overflow while processing a PPP packet
-
High 7.5
Reachable assertion in Modem
Transient DOS due to reachable assertion in modem during MIB reception and SIB timeout
-
High 7.5
Reachable assertion in Modem
Transient DOS due to reachable assertion in modem when network repeatedly sent invalid message container for NR to LTE handover.
-
High 7.5
Reachable assertion in Modem
Transient DOS due to reachable assertion in Modem while processing SIB1 Message.
-
High 7.5
Reachable assertion in Modem
Transient DOS in modem due to reachable assertion.
-
High 7.5
Buiffer over-read in WLAN Firmware.
Transient DOS due to buffer over-read in WLAN Firmware while parsing secure FTMR frame with size lesser than 39 Bytes.
-
High 7.5
Reachable Assertion in WLAN Embedded SW
Transient DOS due to reachable assertion in WLAN while processing PEER ID populated by TQM.
-
High 7.5
Buffer Over-read in WLAN
Transient DOS due to buffer over-read in WLAN while sending a packet to device.
-
High 7.3
Double free in Video
Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms.
-
High 7.3
Improper Validation of Array Index in Bluetooth HOST
Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response.
-
Medium 6.8
Improper input validation with Exynos Fastboot USB Interface prior to SMR Apr-2023 Release 1 allows a physical attacker…
-
Medium 6.8
Improper input validation with Exynos Fastboot USB Interface prior to SMR Apr-2023 Release 1 allows a physical attacker…
-
Medium 6.8
An issue was discovered in Samsung Exynos Mobile Processor and Baseband Modem Processor for Exynos 1280, Exynos 2200, a…
-
Medium 6.7
In buildPropFile of filesystem.go, there is a possible insecure hash due to an improperly used crypto. This could lead …
-
Medium 6.4
In ion, there is a possible escalation of privilege due to improper locking. This could lead to local escalation of pri…
-
Medium 6.3
Intent redirection vulnerability in SecSettings prior to SMR Apr-2022 Release 1 allows attackers to access arbitrary fi…
-
Medium 6.2
Information Exposure in Graphics
Information Disclosure in Graphics during GPU context switch.
-
Medium 6.0
Improper input validation vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows local attackers to ac…
-
Medium 5.9
Improper access control vulnerability in Telephony prior to SMR Apr-2023 Release 1 allows attackers to access files wit…
-
Medium 5.5
In SendIncDecRestoreCmdPart2 of NxpMfcReader.cc, there is a possible out of bounds read due to a missing bounds check. …
-
Medium 5.5CVE-2023-20909 Public exploit
In multiple functions of RunningTasks.java, there is a possible privilege escalation due to a missing privilege check. …
-
Medium 5.5
In deserialize of multiple files, there is a possible out of bounds read due to a missing bounds check. This could lead…
-
Medium 5.5
In register_notification_rsp of btif_rc.cc, there is a possible out of bounds read due to a missing bounds check. This …
-
Medium 5.5
In getNumberFromCallIntent of NewOutgoingCallIntentBroadcaster.java, there is a possible way to enumerate other user's …
-
Medium 5.5
In PreferencesHelper.java, an uncaught exception may cause the device to get stuck in a boot loop. This could lead to l…
-
Medium 5.5
In canDisplayLocalUi of AppLocalePickerActivity.java, there is a possible way to change system app locales due to a mis…
-
Medium 5.3
PendingIntent hijacking vulnerability in CertificatePolicy in framework prior to SMR Apr-2023 Release 1 allows local at…
-
Medium 5.3
Improper authorization in Smart suggestions prior to SMR Apr-2023 Release 1 in Android 13 and 4.1.01.0 in Android 12 al…
-
Medium 5.0
In parseUsesPermission of ParsingPackageUtils.java, there is a possible boot loop due to resource exhaustion. This coul…
-
Medium 4.6
Error in 3GPP specification implementation in Exynos baseband prior to SMR Apr-2023 Release 1 allows incorrect handling…
-
Medium 4.0
Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local attackers to get device…
-
Medium 4.0
Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local attackers to get device…
-
Medium 4.0
Improper access control vulnerability in SemClipboard prior to SMR Apr-2023 Release 1 allows attackers to read arbitrar…
-
Unscored —
When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds.
-
Unscored —CVE-2022-20463 Rejected
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigat…
-
Unscored —
In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
-
Unscored —
In gpu device, there is a memory corruption due to a use after free. This could lead to local denial of service in kern…
-
Unscored —
In telephone service, there is a missing permission check. This could lead to local escalation of privilege with system…
-
Unscored —
In telephone service, there is a missing permission check. This could lead to local escalation of privilege with system…
-
Unscored —
In adsp, there is a possible escalation of privilege due to a logic error. This could lead to local escalation of privi…
-
Unscored —
In tinysys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation …
Revision history
-
#4
Referenz(en) aufgenommen: EUVD-2023-25638, EUVD-2023-25637, EUVD-2023-25636
-
#3
Referenz(en) aufgenommen: EUVD-2023-25648, EUVD-2023-25634, EUVD-2023-25647, EUVD-2023-25646, EUVD-2023-25645, EUVD-2023-25644, EUVD-2023-25643, EUVD-2023-25641, EUVD-2023-25640, EUVD-2023-25639, EUVD-2023-25635
-
#2
Referenz(en) aufgenommen: EUVD-2023-25642
-
#1
Initiale Fassung
References
-
Samsung Security Advisory vom 2023-04-03
https://semiconductor.samsung.com/support/quality-support/product-security-updates/
-
Samsung Security Advisory vom 2023-04-03
https://security.samsungmobile.com/securityUpdate.smsb