Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Pixel ausnutzen, um seine Privilegien zu erhöhen, Informationen offenzulegen, einen Denial of Service zu verursachen oder beliebigen Programmcode auszuführen.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 107
-
Medium 6.2CVE-2023-21237 Exploited
In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification…
KEV Mar 5, 2024 -
High 7.8
In removePermission of PermissionManagerServiceImpl.java, there is a possible way to obtain dangerous permissions witho…
-
High 7.8
In getAvailabilityStatus of EnableContentCapturePreferenceController.java, there is a possible way to bypass DISALLOW_C…
-
High 7.5
In multiple functions of PasspointXmlUtils.java, there is a possible authentication misconfiguration due to a logic err…
-
High 7.3
In getConfirmationMessage of DefaultAutofillPicker.java, there is a possible way to mislead the user to select default …
-
Medium 6.7
Buffer copy without checking the size of input in Core
Memory corruption in core due to buffer copy without check9ing the size of input while processing ioctl queries.
-
Medium 6.7
Buffer copy without checking the size of input in Core
Memory corruption due to buffer copy without checking the size of input in Core while processing ioctl commands from diag client applications.
-
Medium 6.7
Double free in Linux-Android
Memory corruption in Linux android due to double free while calling unregister provider after register call.
-
Medium 6.7
Buffer copy without checking the size of input in FM Host
Memory corruption in FM Host due to buffer copy without checking the size of input in FM Host
-
Medium 6.7
Incorrect type conversion or cast in Audio
Memory corruption in Audio due to incorrect type cast during audio use-cases.
-
Medium 6.7
Use after free in Core
Memory corruption due to use after free in Core when multiple DCI clients register and deregister.
-
Medium 6.7
Improper restriction of operations within the bounds of memory buffer in Linux
Memory corruption in Linux while sending DRM request.
-
Medium 6.5
Improper authentication in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to disable the networ…
-
Medium 5.5
Uncontrolled resource consumption in Linux kernel
Transient DOS due to uncontrolled resource consumption in Linux kernel when malformed messages are sent from the Gunyah Resource Manager message queue.
-
Medium 5.5
In btm_vendor_specific_evt of btm_devctl.cc, there is a possible out of bounds read due to a missing bounds check. This…
-
Medium 5.5
In btm_create_conn_cancel_complete of btm_sec.cc, there is a possible out of bounds read due to a missing bounds check.…
-
Medium 5.5
In btm_ble_add_resolving_list_entry_complete of btm_ble_privacy.cc, there is a possible out of bounds read due to a mis…
-
Medium 5.5
In GetNextSourceDataPacket of bta_av_co.cc, there is a possible out of bounds read due to a missing bounds check. This …
-
Medium 4.7
In setPowerMode of HWC2.cpp, there is a possible out of bounds read due to a race condition. This could lead to local i…
-
Medium 4.5
In btm_read_rssi_complete of btm_acl.cc, there is a possible out of bounds read due to a missing bounds check. This cou…
-
Medium 4.4
In multiple functions of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This coul…
-
Medium 4.4
In btm_ble_read_remote_features_complete of btm_ble_gap.cc, there is a possible out of bounds read due to improper inpu…
-
Medium 4.4
In btm_ble_write_adv_enable_complete of btm_ble_gap.cc, there is a possible out of bounds read due to a missing bounds …
-
Unscored —
In btu_ble_ll_conn_param_upd_evt of btu_hcif.cc, there is a possible out of bounds read due to a missing bounds check. …
-
Unscored —
In btu_ble_rc_param_req_evt of btu_hcif.cc, there is a possible out of bounds read due to a missing bounds check. This …
-
Unscored —
In btm_read_tx_power_complete of btm_acl.cc, there is a possible out of bounds read due to a missing bounds check. This…
-
Unscored —
In btm_ble_rand_enc_complete of btm_ble.cc, there is a possible out of bounds read due to a missing bounds check. This …
-
Unscored —
In ParseBqrLinkQualityEvt of btif_bqr.cc, there is a possible out of bounds read due to a missing bounds check. This co…
-
Unscored —
In BTA_GATTS_HandleValueIndication of bta_gatts_api.cc, there is a possible out of bounds write due to improper input v…
-
Unscored —
In btm_ble_clear_resolving_list_completecomplete of btm_ble_privacy.cc, there is a possible out of bounds read due to a…
-
Unscored —
In btm_read_link_quality_complete of btm_acl.cc, there is a possible out of bounds read due to a missing bounds check. …
-
Unscored —
In btm_ble_rand_enc_complete of btm_ble.cc, there is a possible out of bounds read due to a missing bounds check. This …
-
Unscored —
In btm_ble_process_periodic_adv_sync_lost_evt of ble_scanner_hci_interface.cc , there is a possible out of bounds read …
-
Unscored —
In on_iso_link_quality_read of btm_iso_impl.h, there is a possible out of bounds read due to a missing bounds check. Th…
-
Unscored —
In cd_CodeMsg of cd_codec.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to …
-
Unscored —
there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege wit…
-
Unscored —
In lwis_i2c_device_disable of lwis_device_i2c.c, there is a possible UAF due to a logic error in the code. This could l…
-
Unscored —
In BuildSetConfig of protocolimsbuilder.cpp, there is a possible out of bounds read due to a missing null check. This c…
-
Unscored —
In registerGsmaServiceIntentReceiver of ShannonRcsService.java, there is a possible way to activate/deactivate RCS serv…
-
Unscored —
In handle_set_parameters_ctrl of hal_socket.c, there is a possible out of bounds read due to an incorrect bounds check.…
-
Unscored —
In the Google BMS kernel module, there is a possible out of bounds write due to a heap buffer overflow. This could lead…
-
Unscored —
In FaceStatsAnalyzer::InterpolateWeightList of face_stats_analyzer.cc, there is a possible out of bounds read due to a …
-
Unscored —
In Do_AIMS_SET_CALL_WAITING of imsservice.cpp, there is a possible out of bounds read due to a missing bounds check. Th…
-
Unscored —
In StoreAdbSerialNumber of protocolmiscbuilder.cpp, there is a possible out of bounds read due to a missing bounds chec…
-
Unscored —
In BuildSetRadioNode of protocolmiscbuilder.cpp, there is a possible out of bounds read due to a missing null check. Th…
-
Unscored —
In BuildGetRadioNode of protocolmiscbulider.cpp, there is a possible out of bounds read due to improper input validatio…
-
Unscored —
In encode of wlandata.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to lo…
-
Unscored —
In encode of miscdata.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to loc…
-
Unscored —
In Parse of simdata.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to loca…
-
Unscored —
In BuildSetTcsFci of protocolmiscbuilder.cpp, there is a possible out of bounds read due to a heap buffer overflow. Thi…
-
Unscored —
In Parse of simdata.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to loca…
-
Unscored —
In setProfileName of DevicePolicyManagerService.java, there is a possible way to crash the SystemUI menu due to a missi…
-
Unscored —
In convertCbYCrY of ColorConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This coul…
-
Unscored —
In inviteInternal of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This could le…
-
Unscored —
In executeSetClientTarget of ComposerCommandEngine.h, there is a possible out of bounds read due to a missing bounds ch…
-
Unscored —
In verifyInputEvent of InputDispatcher.cpp, there is a possible way to conduct click fraud due to side channel informat…
-
Unscored —
In multiple functions of WifiCallingSettings.java, there is a possible way to change calling preferences for the admin …
-
Unscored —CVE-2023-21173 Public exploit
In multiple methods of DataUsageList.java, there is a possible way to learn about admin user's network activities due t…
-
Unscored —
In isPageSearchEnabled of BillingCycleSettings.java, there is a possible way for the guest user to change data limits d…
-
Unscored —
In onCreate of DataUsageSummary.java, there is a possible method for a guest user to enable or disable mobile data due …
-
Unscored —
In list_key_entries of utils.rs, there is a possible way to disable user credentials due to resource exhaustion. This c…
-
Unscored —
In requestAppKeyboardShortcuts of WindowManagerService.java, there is a possible way to infer the app a user is interac…
-
Unscored —
In installKey of KeyUtil.cpp, there is a possible failure of file encryption due to a race condition. This could lead t…
-
Unscored —
In parseSecurityParamsFromXml of XmlUtil.java, there is a possible bypass of user specified wifi encryption protocol du…
-
Unscored —
In xmlParseTryOrFinish of parser.c, there is a possible out of bounds read due to a heap buffer overflow. This could le…
-
Unscored —
In btm_ble_update_inq_result of btm_ble_gap.cc, there is a possible out of bounds read due to a heap buffer overflow. T…
-
Unscored —
In Exynos_parsing_user_data_registered_itu_t_t35 of VendorVideoAPI.cpp, there is a possible out of bounds read due to a…
-
Unscored —
In ForegroundUtils of ForegroundUtils.java, there is a possible way to read NFC tag data while the app is still in the …
-
Unscored —
In getCurrentPrivilegedPackagesForAllUsers of CarrierPrivilegesTracker.java, there is a possible permission bypass due …
-
Unscored —
In multiple functions of WifiNetworkFactory.java, there is a missing permission check. This could lead to local escalat…
-
Unscored —
In LogResponse of Dns.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to rem…
-
Unscored —
In onCreate of UsbAccessoryUriActivity.java, there is a possible way to escape the Setup Wizard due to a logic error in…
-
Unscored —
In btm_ble_update_inq_result of btm_ble_gap.cc, there is a possible out of bounds read due to a heap buffer overflow. T…
-
Unscored —
In startLockTaskMode of LockTaskController.java, there is a possible bypass of lock task mode due to a logic error in t…
-
Unscored —
In btm_acl_encrypt_change of btm_acl.cc, there is a possible way for a remote device to turn off encryption without res…
-
Unscored —
In fixNotification of NotificationManagerService.java, there is a possible bypass of notification hide preference due t…
-
Unscored —
In setInputMethodWithSubtypeIdLocked of InputMethodManagerService.java, there is a possible way to setup input methods …
-
Unscored —
In VideoFrame of VideoFrame.h, there is a possible abort due to an integer overflow. This could lead to remote informat…
-
Unscored —
In gatt_dbg_op_name of gatt_utils.cc, there is a possible out of bounds read due to a missing bounds check. This could …
-
Unscored —
In btm_ble_periodic_adv_sync_tx_rcvd of btm_ble_gap.cc, there is a possible out of bounds read due to an incorrect boun…
-
Unscored —
In btm_ble_batchscan_filter_track_adv_vse_cback of btm_ble_batchscan.cc, there is a possible out of bounds read due to …
-
Unscored —
In btm_acl_process_sca_cmpl_pkt of btm_acl.cc, there is a possible out of bounds read due to an incorrect bounds check.…
-
Unscored —
In remove_sdp_record of btif_sdp_server.cc, there is a possible out of bounds read due to a missing bounds check. This …
-
Unscored —
In btu_ble_proc_ltk_req of btu_hcif.cc, there is a possible out of bounds read due to a missing bounds check. This coul…
-
Unscored —
In on_remove_iso_data_path of btm_iso_impl.h, there is a possible out of bounds read due to improper input validation. …
-
Unscored —
In on_create_record_event of btif_sdp_server.cc, there is a possible out of bounds read due to a missing null check. Th…
-
Unscored —
In btm_delete_stored_link_key_complete of btm_devctl.cc, there is a possible out of bounds read due to a missing bounds…
-
Unscored —
In startWpsPbcInternal of sta_iface.cpp, there is a possible out of bounds read due to improper input validation. This …
-
Unscored —
In multiple files, there is a possible out of bounds read due to a missing bounds check. This could lead to local infor…
-
Unscored —
In startWpsPinDisplayInternal of sta_iface.cpp, there is a possible out of bounds read due to unsafe deserialization. T…
-
Unscored —
In initiateVenueUrlAnqpQueryInternal of sta_iface.cpp, there is a possible out of bounds read due to unsafe deserializa…
-
Unscored —
In initiateTdlsSetupInternal of sta_iface.cpp, there is a possible out of bounds read due to a missing bounds check. Th…
-
Unscored —
In setCountryCodeInternal of sta_iface.cpp, there is a possible out of bounds read due to improper input validation. Th…
-
Unscored —
In multiple functions of sta_iface.cpp, there is a possible out of bounds read due to unsafe deserialization. This coul…
-
Unscored —
In initiateHs20IconQueryInternal of sta_iface.cpp, there is a possible out of bounds read due to improper input validat…
-
Unscored —
In multiple files, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local infor…
-
Unscored —
In multiple files, there is a possible out of bounds read due to a missing bounds check. This could lead to local infor…
-
Unscored —
In initiateTdlsTeardownInternal of sta_iface.cpp, there is a possible out of bounds read due to a missing bounds check.…
-
Unscored —
In addGroupWithConfigInternal of p2p_iface.cpp, there is a possible out of bounds read due to unsafe deserialization. T…
-
Unscored —
there is a possible use of unencrypted transport over cellular networks due to an insecure default value. This could le…
-
Unscored —
there is a possible use of unencrypted transport over cellular networks due to an insecure default value. This could le…
-
Unscored —
In load_dt_data of storage.c, there is a possible out of bounds write due to a missing bounds check. This could lead to…
-
Unscored —
In LPP_ConvertGNSS_DataBitAssistance of LPP_CommonUtil.c, there is a possible out of bounds read due to a missing bound…
-
Unscored —
In ss_ProcessReturnResultComponent of ss_MmConManagement.c, there is a possible out of bounds read due to a heap buffer…
-
Unscored —
there is a possible way to bypass the protected confirmation screen due to Failure to lock display power. This could le…
-
Unscored —
In SAEMM_RetrieveTaiList of SAEMM_ContextManagement.c, there is a possible out of bounds read due to an incorrect bound…
-
Unscored —
In aoc_service_set_read_blocked of aoc.c, there is a possible out of bounds write due to a missing bounds check. This c…
Revision history
-
#2
CVE-2023-21237 wird ausgenutzt
-
#1
Initiale Fassung
References
-
Pixel-Update-Bulletin – Juni 2023 vom 2023-06-13
https://source.android.com/docs/security/bulletin/pixel/2023-06-01