Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, seine Privilegien zu erweitern, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 121
-
Critical 9.6CVE-2023-2136 Exploited
Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the ren…
KEV Apr 21, 2023 -
High 8.8CVE-2021-29256 Exploited
. The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information …
KEV Jul 7, 2023 -
High 7.8
Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages. This affects…
KEV Mar 30, 2023 -
Low 3.3
Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifros…
KEV Apr 7, 2023 -
Critical 9.3
Time-of-check time-of-use race condition in Core
Memory corruption in Core due to time-of-check time-of-use race condition during dump collection in trust zone.
-
High 8.5
Improper input validation vulnerability in SCEPProfile prior to SMR Jul-2023 Release 1 allows local attackers to launch…
-
High 8.5
Improper input validation vulnerability in LSOItemData prior to SMR Jul-2023 Release 1 allows attackers to launch certa…
-
High 8.5
Improper input validation vulnerability in DataProfile prior to SMR Jul-2023 Release 1 allows local attackers to launch…
-
High 8.5
Improper input validation vulnerability in RegisteredMSISDN prior to SMR Jul-2023 Release 1 allows local attackers to l…
-
High 8.4
Stack-based buffer overflow in Core
Memory corruption in Core due to stack-based buffer overflow.
-
High 8.4
Stack based buffer overflow in Core
Memory corruption in core due to stack-based buffer overflow
-
High 8.4
Stack based buffer overflow in Core
Memory corruption due to stack-based buffer overflow in Core
-
High 8.4
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN HAL
Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command.
-
High 8.4
Use After Free in Audio
Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions.
-
High 8.4
Integer Overflow or Wraparound in Audio
Memory Corruption in Audio while allocating the ion buffer during the music playback.
-
High 8.2
Buffer Over-read in WLAN HOST
Information Disclosure in WLAN HOST while sending DPP action frame to peer with an invalid source address.
-
High 7.9
Stack-based buffer overflow in Modem
Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message.
-
High 7.8
Use after free in Qualcomm IPC
Memory corruption in Qualcomm IPC due to use after free while receiving the incoming packet and reposting it.
-
High 7.8
In dialer service, there is a possible missing permission check. This could lead to local escalation of privilege with …
-
High 7.8
In showNextSecurityScreenOrFinish of KeyguardSecurityContainerController.java, there is a possible way to access the lo…
-
High 7.8
Improper Input Validation in WLAN HOST
Memory corruption in WLAN HOST while receiving an WMI event from firmware.
-
High 7.8
Improper Input Validation in Audio
Memoru corruption in Audio when ADSP sends input during record use case.
-
High 7.8
Improper Access control in GPU Subsystem
Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode.
-
High 7.8
Buffer Copy Without Checking Size of Input in WLAN HOST
Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory.
-
High 7.8
Use of Out-of-range Pointer Offset in Qualcomm IPC
Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.
-
High 7.8
Buffer Copy Without Checking Size of Input in WLAN HOST
Memory Corruption in WLAN HOST while parsing QMI response message from firmware.
-
High 7.8
Stack-based Buffer Overflow in WLAN HOST
Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message.
-
High 7.8
Buffer Over-read in WLAN Host
Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.
-
High 7.8
Buffer Over-read in WLAN HOST
Memory Corruption in WLAN HOST while fetching TX status information.
-
High 7.8
Stack out of bound write vulnerability in CdmaSmsParser of RILD prior to SMR Jul-2023 Release 1 allows attackers to exe…
-
High 7.8
Heap out of bound write vulnerability in IpcRxIncomingCBMsg of RILD prior to SMR Jul-2023 Release 1 allows attackers to…
-
High 7.8
Heap out of bound write vulnerability in BroadcastSmsConfig of RILD prior to SMR Jul-2023 Release 1 allows attackers to…
-
High 7.8
Heap out of bound write vulnerability in IpcRxUsimPhoneBookCapa of RILD prior to SMR Jul-2023 Release 1 allows attacker…
-
High 7.8
Heap out of bound write vulnerability in RmtUimNeedApdu of RILD prior to SMR Jul-2023 Release 1 allows attackers to exe…
-
High 7.7
Missing authentication vulnerability in Galaxy Themes Service prior to SMR Jul-2023 Release 1 allows local attackers to…
-
High 7.5
Reachable Assertion in Modem
Assertion occurs while processing Reconfiguration message due to improper validation
-
High 7.5
Reachable assertion in Modem
Transient DOS due to reachable assertion in Modem because of invalid network configuration.
-
High 7.5
Improper authorization in Modem
Transient DOS due to improper authorization in Modem
-
High 7.5
Improper authentication in Modem
Transient DOS due to improper authentication in modem while receiving plain TLB OTA request message from network.
-
High 7.5
Reachable assertion in Modem
Transient DOS due to reachable assertion in modem while processing sib with incorrect values from network.
-
High 7.5
Improper Input Validation in Modem
Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received from network.
-
High 7.5
Buffer Over-Read in WLAN Firmware
Transient DOS in WLAN Firmware while processing the received beacon or probe response frame.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN Firmware while processing frames with missing header fields.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS while parsing WLAN beacon or probe-response frame.
-
High 7.3
In telephony service, there is a possible missing permission check. This could lead to local escalation of privilege wi…
-
High 7.3
In cp_dump driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local deni…
-
High 7.1
Information exposure in Kernel
Information disclosure in Kernel due to indirect branch misprediction.
-
High 7.1
Improper access control in Kernel
Memory corruption due to improper access control in kernel while processing a mapping request from root process.
-
Medium 6.8
Double Free in Modem
Memory Corruption in Modem due to double free while parsing the PKCS15 sim files.
-
Medium 6.7
Improper Restriction of Operations within the Bounds of a Memory Buffer in Linux
Memory Corruption in Linux while processing QcRilRequestImsRegisterMultiIdentityMessage request.
-
Medium 6.7
Buffer Copy without Checking Size of Input in Data Network Stack & Connectivity
Memory Corruption in Data Network Stack & Connectivity when sim gets detected on telephony.
-
Medium 6.7
Improper Restrictions of Operations within the Bounds of a Memory Buffer in Linux
Memory corruption in Linux while calling system configuration APIs.
-
Medium 6.7
Incorrect Type Conversion or Cast in Video
Memory corruption in Video while calling APIs with different instance ID than the one received in initialization.
-
Medium 6.7
Buffer Copy Without Checking the Size of Input in Audio
Memory corruption in Audio while processing sva_model_serializer using memory size passed by HIDL client.
-
Medium 6.7
Buffer Copy Without Checking Size of Input in Linux
Memory corruption in Linux when the file upload API is called with parameters having large buffer.
-
Medium 6.7
Out of bounds read and write in callrunTspCmd of sysinput HAL service prior to SMR Jul-2023 Release 1 allows local atta…
-
Medium 6.7
Out of bounds read and write in callgetTspsysfs of sysinput HAL service prior to SMR Jul-2023 Release 1 allows local at…
-
Medium 6.7
Out of bounds read and write in callrunTspCmdNoRead of sysinput HAL service prior to SMR Jul-2023 Release 1 allows loca…
-
Medium 6.7
Out of bounds read and write in enableTspDevice of sysinput HAL service prior to SMR Jul-2023 Release 1 allows local at…
-
Medium 6.7
Out-of-bounds Write in BuildOemSecureSimLockResponse of libsec-ril prior to SMR Jul-2023 Release 1 allows local attacke…
-
Medium 6.7
Out-of-bounds Write in DoOemFactorySendFactoryTestResult of libsec-ril prior to SMR Jul-2023 Release 1 allows local att…
-
Medium 6.7
Out-of-bounds Write in BuildIpcFactoryDeviceTestEvent of libsec-ril prior to SMR Jul-2023 Release 1 allows local attack…
-
Medium 6.6
Permissions, Privileges, and Access Controls in Display
An app with non-privileged access can change global system brightness and cause undesired system behavior.
-
Medium 6.3
Logic error in package installation via adb command prior to SMR Jul-2023 Release 1 allows local attackers to downgrade…
-
Medium 6.2
Untrusted Pointer Dereference in Core
Transient DOS due to untrusted Pointer Dereference in core while sending USB QMI request.
-
Medium 6.2
Information Exposure in DSP Services
Information disclosure in DSP Services while loading dynamic module.
-
Medium 6.2
Improper privilege management vulnerability in Galaxy Themes Service prior to SMR Jul-2023 Release 1 allows local attac…
-
Medium 6.2
Improper input validation vulnerability in EnhancedAttestationResult prior to SMR Jul-2023 Release 1 allows local attac…
-
Medium 6.2
Improper input validation vulnerability in Transaction prior to SMR Jul-2023 Release 1 allows local attackers to launch…
-
Medium 6.2
Exposure of Sensitive Information vulnerability in getDefaultChipId in UwbAospAdapterService prior to SMR Jul-2023 Rele…
-
Medium 6.2
Exposure of Sensitive Information vulnerability in getChipInfos in UwbAospAdapterService prior to SMR Jul-2023 Release …
-
Medium 6.2
Exposure of Sensitive Information vulnerability in getChipIds in UwbAospAdapterService prior to SMR Jul-2023 Release 1 …
-
Medium 5.5
In telephony service, there is a possible missing permission check. This could lead to local denial of service with no …
-
Medium 5.5
In add of WifiNetworkSuggestionsManager.java, there is a possible way to trigger permanent DoS due to resource exhausti…
-
Medium 5.5
In PreferencesHelper.java, an uncaught exception may cause the device to get stuck in a boot loop. This could lead to l…
-
Medium 5.5
An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing opera…
-
Medium 5.3
Improper input validation vulnerability in OemPersonalizationSetLock in libsec-ril prior to SMR Jul-2023 Release 1 allo…
-
Medium 5.3
Improper input validation vulnerability in DoOemImeiSetPreconfig in libsec-ril prior to SMR Jul-2023 Release 1 allows l…
-
Medium 5.1
Improper access control in Audio system service prior to SMR Jul-2023 Release 1 allows attacker to send broadcast with …
-
Medium 4.6
The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB de…
-
Medium 4.4
Improper input validation vulnerability in OnOemServiceMode in libsec-ril prior to SMR Jul-2023 Release 1 allows local …
-
Medium 4.3
Improper access control vulnerability in PersonaManagerService prior to SMR Jul-2023 Release 1 allows local attackers t…
-
Medium 4.3
Improper access control vulnerability in Settings prior to SMR Jul-2023 Release 1 allows physical attacker to use restr…
-
Low 3.3
An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU memory processin…
-
Low 3.3
Stack out-of-bounds write vulnerability in IpcRxImeiUpdateImeiNoti of RILD priro to SMR Jul-2023 Release 1 cause a deni…
-
Unscored —
In PVRSRVBridgeSyncPrimOpCreate of the PowerVR kernel driver, a missing size check means there is a possible integer ov…
-
Unscored —
In _PMRCreate of the PowerVR kernel driver, a missing bounds check means it is possible to overwrite heap memory via Ph…
-
Unscored —
The PVRSRVBridgeGetMultiCoreInfo ioctl in the PowerVR kernel driver can return uninitialized kernel memory to user spac…
-
Unscored —
Arm Mali GPU Kernel Driver has a use-after-free: Midgard r28p0 through r29p0 before r30p0, Bifrost r17p0 through r23p0 …
-
Unscored —
Arm Mali GPU Kernel Driver allows improper GPU operations in Valhall r29p0 through r36p0 before r37p0 to reach a use-af…
-
Unscored —CVE-2022-42703 Public exploit
mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
-
Unscored —
In keyinstall, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation …
-
Unscored —
In keyinstall, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation …
-
Unscored —CVE-2023-20918 Public exploit
In getPendingIntentLaunchFlags of ActivityOptions.java, there is a possible elevation of privilege due to a confused de…
-
Unscored —
In openMmapStream of AudioFlinger.cpp, there is a possible way to record audio without displaying the microphone privac…
-
Unscored —
In multiple functions of WVDrmPlugin.cpp, there is a possible use after free due to a race condition. This could lead t…
-
Unscored —
In multiple functions of cdm_engine.cpp, there is a possible use-after-free due to improper locking. This could lead to…
-
Unscored —
In updatePictureInPictureMode of ActivityRecord.java, there is a possible bypass of background launch restrictions due …
-
Unscored —CVE-2023-21238 Public exploit
In visitUris of RemoteViews.java, there is a possible leak of images between users due to a confused deputy. This could…
-
Unscored —
In visitUris of Notification.java, there is a possible way to leak image data across user boundaries due to a confused …
-
Unscored —
In Policy of Policy.java, there is a possible boot loop due to resource exhaustion. This could lead to local denial of …
-
Unscored —
In rw_i93_send_to_upper of rw_i93.cc, there is a possible out of bounds write due to an integer overflow. This could le…
-
Unscored —
In validateForCommonR1andR2 of PasspointConfiguration.java, there is a possible way to inflate the size of a config fil…
-
Unscored —CVE-2023-21246 Public exploit
In ShortcutInfo of ShortcutInfo.java, there is a possible way for an app to retain notification listening access due to…
-
Unscored —
In getAvailabilityStatus of BluetoothScanningMainSwitchPreferenceController.java, there is a possible way to bypass a d…
-
Unscored —
In getAvailabilityStatus of WifiScanningMainSwitchPreferenceController.java, there is a possible way to bypass a device…
-
Unscored —
In multiple functions of OneTimePermissionUserManager.java, there is a possible one-time permission retention due to a …
-
Unscored —
In gatt_end_operation of gatt_utils.cc, there is a possible out of bounds write due to a missing bounds check. This cou…
-
Unscored —CVE-2023-21251 Public exploit
In onCreate of ConfirmDialog.java, there is a possible way to connect to VNP bypassing user's consent due to improper i…
-
Unscored —
In getCurrentState of OneTimePermissionUserManager.java, there is a possible way to hold one-time permissions after the…
-
Unscored —
In multiple functions of binder.c, there is a possible memory corruption due to a use after free. This could lead to lo…
-
Unscored —
In SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities via Settings due to a logic er…
-
Unscored —
In updateSettingsInternalLI of InstallPackageHelper.java, there is a possible way to sideload an app in the work profil…
-
Unscored —CVE-2023-21261 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
In startInput of AudioPolicyInterfaceImpl.cpp, there is a possible way of erroneously displaying the microphone privacy…
-
Unscored —
there is a possible way to bypass cryptographic assurances due to a logic error in the code. This could lead to local e…
-
Unscored —
In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking. This could l…
-
Unscored —
there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with …
-
Unscored —
In getLocationCache of GeoLocation.java, there is a possible way to send a mock location during an emergency call due t…
-
Unscored —
In incfs_kill_sb of fs/incfs/vfs.c, there is a possible memory corruption due to a use after free. This could lead to l…
-
Unscored —
In DMPixelLogger_ProcessDmCommand of DMPixelLogger.cpp, there is a possible out of bounds read due to a missing bounds …
Revision history
-
#4
Neue Updates von Ubuntu aufgenommen
-
#3
Neue Updates von Ubuntu aufgenommen
-
#2
Neue Updates von Samsung aufgenommen
-
#1
Initiale Fassung
References
-
Ubuntu Security Notice USN-6348-1 vom 2023-09-06
https://ubuntu.com/security/notices/USN-6348-1
-
Ubuntu Security Notice USN-6315-1 vom 2023-08-29
https://ubuntu.com/security/notices/USN-6315-1
-
Samsung Patchday July 2023 vom 2023-07-13
https://security.samsungmobile.com/securityUpdate.smsb
-
Pixel Patchday July 2023 vom 2023-07-05
https://source.android.com/docs/security/bulletin/pixel/2023-07-01?hl=de
-
Android Patchday July 2023 vom 2023-07-05
https://source.android.com/docs/security/bulletin/2023-07-01