Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android Pixel ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen, seine Privilegien zu erweitern und Daten zu manipulieren.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 28
-
Medium 6.7
Buffer over-read in Modem
Memory corruption due to buffer over-read in Modem while processing SetNativeHandle RTP service.
-
Medium 6.7
Improper Validation of Array Index in Linux
Memory Corruption due to improper validation of array index in Linux while updating adn record.
-
Medium 6.7
Integer Overflow to Buffer Overflow in RIL
Memory corruption in RIL due to Integer Overflow while triggering qcril_uim_request_apdu request.
-
Medium 6.7
Improper Restriction of Operations within the Bounds of a Memory Buffer in Audio
Memory corruption in Audio during playback session with audio effects enabled.
-
Medium 6.7
Integer Overflow or Wraparound in Display
Memory corruption in Audio while validating and mapping metadata.
-
Medium 6.7
Improper Restrictions of Operations within the Bounds of a Memory Buffer in Display
Memory Corruption while accessing metadata in Display.
-
Medium 6.7
Buffer Copy Without Checking Size of Input in VR Service
Memory Corruption in VR Service while sending data using Fast Message Queue (FMQ).
-
Medium 6.6
Buffer Copy Without Checking Size of Input in WLAN Host
Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.
-
Medium 6.5
Buffer Over-read in Bluetooth HOST
Transient DOS in Bluetooth HOST while passing descriptor to validate the blacklisted BT keyboard.
-
Medium 6.1
Buffer Over-read in WLAN HOST
Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan.
-
Medium 5.1
Buffer over-read in Automotive multimedia
Information disclosure in Automotive multimedia due to buffer over-read.
-
Unscored —
In tbd of tbd, there is a possible memory corruption due to a race condition. This could lead to local escalation of pr…
-
Unscored —
In TBD of TBD, there is a possible stack buffer overflow due to a missing bounds check. This could lead to remote code …
-
Unscored —
In ProtocolEmbmsGlobalCellIdAdapter::Init() of protocolembmsadapter.cpp, there is a possible out of bounds read due to …
-
Unscored —
In ProtocolMiscLceIndAdapter::GetConfLevel() of protocolmiscadapter.cpp, there is a possible out of bounds read due to …
-
Unscored —
In several functions of Exynos modem files, there is a possible out of bounds write due to a missing bounds check. This…
-
Unscored —
In ProtocolEmergencyCallListIndAdapter::Init of protocolcalladapter.cpp, there is a possible out of bounds read due to …
-
Unscored —
In TBD of TBD, there is a possible way to access location information due to a permissions bypass. This could lead to l…
-
Unscored —
In ctrl_roi of stmvl53l1_module.c, there is a possible out of bounds read due to an incorrect bounds check. This could …
-
Unscored —
In CanConvertPadV2Op of darwinn_mlir_converter_aidl.cc, there is a possible out of bounds read due to a heap buffer ove…
-
Unscored —
In multiple functions of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check…
-
Unscored —
In lwis_transaction_client_cleanup of lwis_transaction.c, there is a possible way to corrupt memory due to a use after …
-
Unscored —
In ProfSixDecomTcpSACKoption of RohcPacketCommon.cpp, there is a possible out of bounds read due to a missing bounds ch…
-
Unscored —
there is a possible out of bounds write due to buffer overflow. This could lead to remote code execution with no additi…
-
Unscored —
In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lea…
-
Unscored —
there is a possible use-after-free write due to improper locking. This could lead to local escalation of privilege with…
-
Unscored —
In temp_residency_name_store of thermal_metrics.c, there is a possible out of bounds write due to a missing bounds chec…
-
Unscored —
In TBD of TBD, there is a possible way to bypass carrier restrictions due to a logic error in the code. This could lead…
Revision history
-
#1
Initiale Fassung
References
-
Google Pixel Security Bulletin October 2023 vom 2023-10-11
https://source.android.com/docs/security/bulletin/pixel/2023-10-01