Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Samsung Android ausnutzen, um seine Privilegien zu erhöhen.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 81
-
High 8.8CVE-2021-29256 Exploited
. The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information …
KEV Jul 7, 2023 -
Low 3.3
Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifros…
KEV Apr 7, 2023 -
Critical 9.8
In processMessageImpl of ClientModeImpl.java, there is a possible credential disclosure in the TOFU flow due to a logic…
-
High 8.4
Use After Free in Audio
Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions.
-
High 8.4
Integer Overflow or Wraparound in Audio
Memory Corruption in Audio while allocating the ion buffer during the music playback.
-
High 8.4
Improper privilege management vulnerability in MMIGroup prior to SMR Aug-2023 Release 1 allows code execution with priv…
-
High 8.4
Parcel mismatch in AuthenticationConfig prior to SMR Aug-2023 Release 1 allows local attacker to privilege escalation.
-
High 7.8
In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way for an app to keep permissions …
-
High 7.8
Buffer Copy Without Checking Size of Input in WLAN HOST
Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory.
-
High 7.8
Use of Out-of-range Pointer Offset in Qualcomm IPC
Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.
-
High 7.8
Buffer Copy Without Checking Size of Input in WLAN HOST
Memory Corruption in WLAN HOST while parsing QMI response message from firmware.
-
High 7.8
Stack-based Buffer Overflow in WLAN HOST
Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message.
-
High 7.8
Buffer Over-read in WLAN Host
Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.
-
High 7.8
Buffer Over-read in WLAN HOST
Memory Corruption in WLAN HOST while fetching TX status information.
-
High 7.8
Improper access control in HDCP trustlet prior to SMR Aug-2023 Release 1 allows local attackers to execute arbitrary co…
-
High 7.5
In multiple locations, there are root CA certificates which need to be disabled. This could lead to remote information …
-
High 7.5
Improper Input Validation in Modem
Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received from network.
-
High 7.5
Out-of-bounds write vulnerability in parser_hvcC function of libsimba library prior to SMR Aug-2023 Release 1 allows co…
-
Medium 6.8
In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a mis…
-
Medium 6.8
In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a mis…
-
Medium 6.8
In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a mis…
-
Medium 6.8
In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a mis…
-
Medium 6.8
Double Free in Modem
Memory Corruption in Modem due to double free while parsing the PKCS15 sim files.
-
Medium 6.7
Improper access control vulnerability in SLocationService prior to SMR Aug-2023 Release 1 allows local attacker to upda…
-
Medium 6.7
Out-of-bounds Write in ReqDataRaw of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitr…
-
Medium 6.7
Out-of-bounds Write in RmtUimApdu of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitr…
-
Medium 6.7
Out-of-bounds Write in MakeUiccAuthForOem of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execut…
-
Medium 6.7
Out-of-bounds Write in BuildOemEmbmsGetSigStrengthResponse of libsec-ril prior to SMR Aug-2023 Release 1 allows local a…
-
Medium 6.7
Out-of-bounds Write in DoOemFactorySendFactoryBypassCommand of libsec-ril prior to SMR Aug-2023 Release 1 allows local …
-
Medium 6.7
Out-of-bounds Write in IpcTxPcscTransmitApdu of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to exe…
-
Medium 5.5
An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing opera…
-
Medium 5.5
Improper access control vulnerability in TelephonyUI prior to SMR Aug-2023 Release 1 allows local attacker to connect B…
-
Medium 5.3
PendingIntent hijacking vulnerability in SemWifiApTimeOutImpl in framework prior to SMR Aug-2023 Release 1 allows local…
-
Medium 4.7
PendingIntent hijacking in WifiGeofenceManager prior to SMR Aug-2023 Release 1 allows local attacker to arbitrary file …
-
Medium 4.6
The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB de…
-
Medium 4.4
An improper input validation vulnerability within initialize function in HAL VaultKeeper prior to SMR Aug-2023 Release …
-
Medium 4.4
An improper input validation in IpcTxGetVerifyAkey in libsec-ril prior to SMR Aug-2023 Release 1 allows attacker to cau…
-
Medium 4.4
An improper input validation in IpcTxCfgSetSimlockPayload in libsec-ril prior to SMR Aug-2023 Release 1 allows attacker…
-
Medium 4.3
Improper access control in Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call silenceRinger API wit…
-
Medium 4.3
Improper access control in Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call endCall API without p…
-
Medium 4.3
Improper access control in Samsung Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call acceptRinging…
-
Medium 4.3
Improper access control vulnerability in Telecom prior to SMR Aug-2023 Release 1 allows local attakcers to change TTY m…
-
Unscored —
The PVRSRVBridgeGetMultiCoreInfo ioctl in the PowerVR kernel driver can return uninitialized kernel memory to user spac…
-
Unscored —
Arm Mali GPU Kernel Driver allows improper GPU operations in Valhall r29p0 through r36p0 before r37p0 to reach a use-af…
-
Unscored —CVE-2022-42703 Public exploit
mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
-
Unscored —
In keyinstall, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation …
-
Unscored —
In keyinstall, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation …
-
Unscored —
In registerServiceLocked of ManagedServices.java, there is a possible bypass of background activity launch restrictions…
-
Unscored —
In onAccessPointChanged of AccessPointPreference.java, there is a possible way for unprivileged apps to receive a broad…
-
Unscored —
In getIntentForButton of ButtonManager.java, there is a possible way for an unprivileged application to start a non-exp…
-
Unscored —
In multiple locations, there is a possible way to retrieve sensor data without permissions due to a permissions bypass.…
-
Unscored —
In multiple locations of avrc, there is a possible leak of heap data due to uninitialized data. This could lead to remo…
-
Unscored —
In launchConfirmationActivity of ChooseLockSettingsHelper.java, there is a possible way to enable developer options wit…
-
Unscored —
In onCreate of LockSettingsActivity.java, there is a possible way set a new lockscreen PIN without entering the existin…
-
Unscored —
In isServerCertChainValid of InsecureEapNetworkHandler.java, there is a possible way to trust an imposter server due to…
-
Unscored —
In multiple functions of binder.c, there is a possible memory corruption due to a use after free. This could lead to lo…
-
Unscored —
In multiple functions of KeyguardViewMediator.java, there is a possible way to bypass lockdown mode with screen pinning…
-
Unscored —
In update of MmsProvider.java, there is a possible way to change directory permissions due to a path traversal error. T…
-
Unscored —
In startActivityInner of ActivityStarter.java, there is a possible way to launch an activity into PiP mode from the bac…
-
Unscored —
In parseInputs of ShimPreparedModel.cpp, there is a possible out of bounds read due to improper input validation. This …
-
Unscored —CVE-2023-21272 Public exploit
In readFrom of Uri.java, there is a possible bad URI permission grant due to improper input validation. This could lead…
-
Unscored —
In SDP_AddAttribute of sdp_db.cc, there is a possible out of bounds write due to an incorrect bounds check. This could …
-
Unscored —
In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. T…
-
Unscored —CVE-2023-21275 Public exploit
In decideCancelProvisioningDialog of AdminIntegratedFlowPrepareActivity.java, there is a possible way to bypass factory…
-
Unscored —
In writeToParcel of CursorWindow.cpp, there is a possible information disclosure due to uninitialized data. This could …
-
Unscored —
In visitUris of RemoteViews.java, there is a possible way to reveal images across users due to a missing permission che…
-
Unscored —
In multiple locations, there is a possible way to obscure the microphone privacy indicator due to a logic error in the …
-
Unscored —
In visitUris of RemoteViews.java, there is a possible cross-user media read due to a confused deputy. This could lead t…
-
Unscored —
In setMediaButtonBroadcastReceiver of MediaSessionRecord.java, there is a possible permanent DoS due to resource exhaus…
-
Unscored —CVE-2023-21281 Public exploit
In multiple functions of KeyguardViewMediator.java, there is a possible failure to lock after screen timeout due to a l…
-
Unscored —CVE-2023-21282 Public exploit
In TRANSPOSER_SETTINGS of lpp_tran.h, there is a possible out of bounds write due to an incorrect bounds check. This co…
-
Unscored —
In multiple functions of StatusHints.java, there is a possible way to reveal images across users due to a confused depu…
-
Unscored —CVE-2023-21284 Public exploit
In multiple functions of DevicePolicyManager.java, there is a possible way to prevent enabling the Find my Device featu…
-
Unscored —CVE-2023-21285 Public exploit
In setMetadata of MediaSessionRecord.java, there is a possible way to view another user's images due to a confused depu…
-
Unscored —CVE-2023-21286 Public exploit
In visitUris of RemoteViews.java, there is a possible way to reveal images across users due to a missing permission che…
-
Unscored —
In multiple locations, there is a possible code execution due to type confusion. This could lead to remote code executi…
-
Unscored —CVE-2023-21288 Public exploit
In visitUris of Notification.java, there is a possible way to reveal images across users due to a missing permission ch…
-
Unscored —
In multiple locations, there is a possible bypass of a multi user security boundary due to a confused deputy. This coul…
-
Unscored —
In update of MmsProvider.java, there is a possible way to bypass file permission checks due to a race condition. This c…
-
Unscored —
In openContentUri of ActivityManagerService.java, there is a possible way for a third party app to obtain restricted fi…
-
Unscored —
In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion …
Revision history
-
#1
Initiale Fassung
References
-
Samsung Security Advisory - SMR-AUG-2023 vom 2023-08-07
https://security.samsungmobile.com/securityUpdate.smsb