Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszulösen.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 88
-
High 7.8CVE-2021-39793 Exploited
In kbase_jd_user_buf_pin_pages of mali_kbase_mem.c, there is a possible out of bounds write due to a logic error in the…
KEV Apr 11, 2022 -
High 7.8
Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages. This affects…
KEV Mar 30, 2023 -
Critical 9.3
Time-of-check time-of-use race condition in Core
Memory corruption in Core due to time-of-check time-of-use race condition during dump collection in trust zone.
-
High 8.4
Double free in Automotive
Memory Corruption due to double free in automotive when a bad HLOS address for one of the lists to be mapped is passed.
-
High 8.4
Double free in Core
Memory corruption due to double free in Core while mapping HLOS address to the list.
-
High 8.4
Stack-based buffer overflow in Core
Memory corruption in Core due to stack-based buffer overflow.
-
High 8.4
Stack based buffer overflow in Core
Memory corruption in core due to stack-based buffer overflow
-
High 8.4
Stack based buffer overflow in Core
Memory corruption due to stack-based buffer overflow in Core
-
High 8.4
Double free in Linux Networking
Memory corruption in Linux Networking due to double free while handling a hyp-assign.
-
High 8.4
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN HAL
Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command.
-
High 8.4
Stack-based Buffer Overflow in Automotive GPU
Memory corruption in Automotive GPU while querying a gsl memory node.
-
High 8.2
Buffer Over-read in WLAN HOST
Information Disclosure in WLAN HOST while sending DPP action frame to peer with an invalid source address.
-
High 7.9
Stack-based buffer overflow in Modem
Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message.
-
High 7.8
Use after free in Qualcomm IPC
Memory corruption in Qualcomm IPC due to use after free while receiving the incoming packet and reposting it.
-
High 7.8
In dialer service, there is a possible missing permission check. This could lead to local escalation of privilege with …
-
High 7.8
Improper Input Validation in WLAN HOST
Memory corruption in WLAN HOST while receiving an WMI event from firmware.
-
High 7.8
Improper Input Validation in Audio
Memoru corruption in Audio when ADSP sends input during record use case.
-
High 7.8
Improper Access control in GPU Subsystem
Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode.
-
High 7.8
In Connectivity Service, there is a possible missing permission check. This could lead to local escalation of privilege…
-
High 7.8
In Connectivity Service, there is a possible missing permission check. This could lead to local escalation of privilege…
-
High 7.5
Reachable Assertion in Modem
Assertion occurs while processing Reconfiguration message due to improper validation
-
High 7.5
Reachable assertion in Modem
Transient DOS due to reachable assertion in Modem because of invalid network configuration.
-
High 7.5
Improper authorization in Modem
Transient DOS due to improper authorization in Modem
-
High 7.5
Improper authentication in Modem
Transient DOS due to improper authentication in modem while receiving plain TLB OTA request message from network.
-
High 7.5
Reachable assertion in Modem
Transient DOS due to reachable assertion in modem while processing sib with incorrect values from network.
-
High 7.5
Buffer Over-Read in WLAN Firmware
Transient DOS in WLAN Firmware while processing the received beacon or probe response frame.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN Firmware while processing frames with missing header fields.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN Firmware while parsing FT Information Elements.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS while parsing WLAN beacon or probe-response frame.
-
High 7.3
In telephony service, there is a possible missing permission check. This could lead to local escalation of privilege wi…
-
High 7.3
In cp_dump driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local deni…
-
High 7.1
Cryptographic issue in Core
information disclosure due to cryptographic issue in Core during RPMB read request.
-
High 7.1
Information exposure in Kernel
Information disclosure in Kernel due to indirect branch misprediction.
-
High 7.1
Information Exposure in Linux Networking Firmware
Information disclosure in Linux Networking Firmware due to unauthorized information leak during side channel analysis.
-
High 7.1
Improper access control in Kernel
Memory corruption due to improper access control in kernel while processing a mapping request from root process.
-
Medium 6.7
Buffer copy without checking the size of input in Core
Memory corruption in core due to buffer copy without check9ing the size of input while processing ioctl queries.
-
Medium 6.7
Buffer copy without checking the size of input in Core
Memory corruption due to buffer copy without checking the size of input in Core while processing ioctl commands from diag client applications.
-
Medium 6.7
Double free in Linux-Android
Memory corruption in Linux android due to double free while calling unregister provider after register call.
-
Medium 6.7
Buffer copy without checking the size of input in FM Host
Memory corruption in FM Host due to buffer copy without checking the size of input in FM Host
-
Medium 6.7
Incorrect type conversion or cast in Audio
Memory corruption in Audio due to incorrect type cast during audio use-cases.
-
Medium 6.7
Use after free in Core
Memory corruption due to use after free in Core when multiple DCI clients register and deregister.
-
Medium 6.7
Improper restriction of operations within the bounds of memory buffer in Linux
Memory corruption in Linux while sending DRM request.
-
Medium 6.2
Untrusted Pointer Dereference in Core
Transient DOS due to untrusted Pointer Dereference in core while sending USB QMI request.
-
Medium 6.2
In dialer service, there is a possible missing permission check. This could lead to local denial of service with no add…
-
Medium 6.2
In dialer service, there is a possible missing permission check. This could lead to local denial of service with no add…
-
Medium 6.2
In dialer service, there is a possible missing permission check. This could lead to local denial of service with no add…
-
Medium 5.9
In telephony service, there is a possible missing permission check. This could lead to local denial of service with no …
-
Medium 5.9
In telephony service, there is a possible missing permission check. This could lead to local denial of service with no …
-
Medium 5.9
In telephony service, there is a possible missing permission check. This could lead to local denial of service with no …
-
Medium 5.5
Uncontrolled resource consumption in Linux kernel
Transient DOS due to uncontrolled resource consumption in Linux kernel when malformed messages are sent from the Gunyah Resource Manager message queue.
-
Medium 5.5
In telephony service, there is a possible missing permission check. This could lead to local denial of service with no …
-
Medium 5.5
In telephony service, there is a possible missing permission check. This could lead to local denial of service with no …
-
Medium 5.5
In telephony service, there is a possible missing permission check. This could lead to local denial of service with no …
-
Medium 5.5
In telephony service, there is a possible missing permission check. This could lead to local denial of service with no …
-
Medium 5.5
In dialer service, there is a missing permission check. This could lead to local information disclosure with no additio…
-
Medium 5.5
In telephony service, there is a missing permission check. This could lead to local information disclosure with no addi…
-
Medium 5.5
In email service, there is a missing permission check. This could lead to local information disclosure with no addition…
-
Medium 5.5
In email service, there is a missing permission check. This could lead to local information disclosure with no addition…
-
Medium 4.4
In cp_dump driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local deni…
-
Low 3.3
An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU memory processin…
-
Unscored —
In PVRSRVBridgeSyncPrimOpCreate of the PowerVR kernel driver, a missing size check means there is a possible integer ov…
-
Unscored —
In _PMRCreate of the PowerVR kernel driver, a missing bounds check means it is possible to overwrite heap memory via Ph…
-
Unscored —
Arm Mali GPU Kernel Driver has a use-after-free: Midgard r28p0 through r29p0 before r30p0, Bifrost r17p0 through r23p0 …
-
Unscored —
In canStartSystemGesture of RecentsAnimationDeviceState.java, there is a possible partial lockscreen bypass due to a ra…
-
Unscored —
In multiple functions of WVDrmPlugin.cpp, there is a possible use after free due to a race condition. This could lead t…
-
Unscored —
In multiple functions of ChooserActivity.java, there is a possible cross-user media read due to a confused deputy. This…
-
Unscored —
In sdpu_build_uuid_seq of sdp_discovery.cc, there is a possible out of bounds write due to a use after free. This could…
-
Unscored —
In btm_sec_encrypt_change of btm_sec.cc, there is a possible way to downgrade the link key type due to improperly used …
-
Unscored —
In multiple functions of cdm_engine.cpp, there is a possible use-after-free due to improper locking. This could lead to…
-
Unscored —
In onResume of AppManagementFragment.java, there is a possible way to prevent users from forgetting a previously connec…
-
Unscored —
In various functions of various files, there is a possible way to bypass the DISALLOW_DEBUGGING_FEATURES restriction fo…
-
Unscored —
In multiple functions of multiple files, there is a possible way to bypass the DISALLOW_DEBUGGING_FEATURES restriction …
-
Unscored —
In run of multiple files, there is a possible escalation of privilege due to unsafe deserialization. This could lead to…
-
Unscored —
In bindOutputSwitcherAndBroadcastButton of MediaControlPanel.java, there is a possible launch arbitrary activity under …
-
Unscored —
In readSampleData of NuMediaExtractor.cpp, there is a possible out of bounds write due to uninitialized data. This coul…
-
Unscored —
In various functions of AppStandbyController.java, there is a possible way to break manageability scenarios due to a lo…
-
Unscored —
In getFullScreenIntentDecision of NotificationInterruptStateProviderImpl.java, there is a possible activity launch whil…
-
Unscored —
In btm_ble_periodic_adv_sync_lost of btm_ble_gap.cc, there is a possible remote code execution due to a buffer overflow…
-
Unscored —
In checkKeyIntentParceledCorrectly() of ActivityManagerService.java, there is a possible bypass of Parcel Mismatch miti…
-
Unscored —
In onCreate of NotificationAccessSettings.java, there is a possible failure to persist notifications settings due to im…
-
Unscored —
In multiple functions of JobStore.java, there is a possible way to cause a crash on startup due to improper input valid…
-
Unscored —
In several methods of JobStore.java, uncaught exceptions in job map parsing could lead to local persistent denial of se…
-
Unscored —
In onNullBinding of CallRedirectionProcessor.java, there is a possible long lived connection due to improper input vali…
-
Unscored —
In bindPlayer of MediaControlPanel.java, there is a possible launch arbitrary activity in SysUI due to Unsafe Intent. T…
-
Unscored —
In several functions of several files, there is a possible way to access developer mode traces due to a permissions byp…
-
Unscored —
In multiple files, there is a possible way to access traces in the dev mode due to a permissions bypass. This could lea…
-
Unscored —
In multiple functions of multiple files, there is a possible way to make the device unusable due to improper input vali…
-
Unscored —
In doInBackground of NotificationContentInflater.java, there is a possible temporary denial or service due to long runn…
Revision history
-
#1
Initiale Fassung
References
-
Google Android Patchday Juni vom 2023-06-05
https://source.android.com/docs/security/bulletin/2023-06-01