Summary
Ein entfernter Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen, einen Denial-of-Service-Zustand zu verursachen oder vertrauliche Informationen offenzulegen.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 94
-
High 8.4CVE-2023-33106 Exploited
Use of Out-of-range Pointer Offset in Graphics
Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.
KEV Dec 5, 2023 -
High 8.4
Integer Overflow or Wraparound in Graphics Linux
Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
KEV Dec 5, 2023 -
High 7.8CVE-2023-33063 Exploited
Use After Free in DSP Services
Memory corruption in DSP Services during a remote call from HLOS to DSP.
KEV Dec 5, 2023 -
Critical 9.8
In RGXBackingZSBuffer of rgxta3d.c, there is a possible arbitrary code execution due to a use after free. This could le…
-
Critical 9.8
In PMRChangeSparseMemOSMem of physmem_osmem_linux.c, there is a possible arbitrary code execution due to a use after fr…
-
Critical 9.8
In multiple functions of MetaDataBase.cpp, there is a possible UAF write due to a race condition. This could lead to re…
-
Critical 9.1
Improper Authentication in GPS HLOS Driver
Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance data.
-
High 8.8
In callback_thread_event of com_android_bluetooth_btservice_AdapterService.cpp, there is a possible memory corruption d…
-
High 8.4
Double free in Core
Memory corruption due to double free in Core while mapping HLOS address to the list.
-
High 8.4
Integer Overflow to Buffer Overflow in HLOS
Memory corruption in HLOS while invoking IOCTL calls from user-space.
-
High 8.4
Improper Validation of Array Index in Kernel
Memory corruption in Kernel while parsing metadata.
-
High 8.4
NULL pointer dereference in WLAN Firmware
Memory corruption when processing cmd parameters while parsing vdev.
-
High 8.4
Buffer Copy Without Checking Size of Input in Bluetooth HOST
Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size.
-
High 8.2
Integer Overflow to Buffer Overflow in TZ Secure OS
Memory corruption while loading an ELF segment in TEE Kernel.
-
High 7.8
Buffer Copy without Checking the Size of Input(Classic Buffer Overflow) in Core Platform
Memory corruption in Core Platform while printing the response buffer in log.
-
High 7.8
Buffer Copy without Checking the Size of Input(Classic Buffer Overflow) in Core Platform
Memory Corruption in Core Platform while printing the response buffer in log.
-
High 7.8
Buffer Copy Without Checking Size of Input in SPS Applications
Memory Corruption in SPS Application while exporting public key in sorter TA.
-
High 7.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in MPP Performance
Memory corruption in MPP performance while accessing DSM watermark using external memory address.
-
High 7.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in UTILS
Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments.
-
High 7.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in BT Controller
Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.
-
High 7.8
Buffer Copy Without Checking Size of Input in Boot
Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.
-
High 7.8
Integer Overflow to Buffer Overflow in User Identity Module
Memory corruption while using the UIM diag command to get the operators name.
-
High 7.8
Use of Out-of-range Pointer Offset in Audio
Memory corruption in Audio while running invalid audio recording from ADSP.
-
High 7.8
Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in Core
Memory corruption in Core while processing RX intent request.
-
High 7.8
Mali GPU Kernel Driver exposes sensitive data from freed memory
A local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain access to already freed memory.
-
High 7.7
Key Management Errors in HLOS
Cryptographic issue in HLOS as derived keys used to encrypt/decrypt information is present on stack after use.
-
High 7.5CVE-2023-28588 Public exploit
Integer Overflow or Wraparound in Bluetooth Host
Transient DOS in Bluetooth Host while rfc slot allocation.
-
High 7.5
Buffer over-read in WLAN Firmware
Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
-
High 7.5
Buffer over-read in WLAN Firmware
Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast.
-
High 7.5
NULL Pointer Dereference in WLAN Firmware
Transient DOS when processing a NULL buffer while parsing WLAN vdev.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN Firmware while processing a FTMR frame.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS while parsing WPA IES, when it is passed with length more than expected size.
-
High 7.1
Cryptographic issue in Core
information disclosure due to cryptographic issue in Core during RPMB read request.
-
Medium 6.7
In vdec, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privileg…
-
Medium 6.7
In vdec, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privileg…
-
Medium 6.0
Improper Restriction of Operation within the Bounds of a Memory Buffer in TZ Secure OS
Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.
-
Medium 5.5
In createPendingIntent of CredentialManagerUi.java, there is a possible way to access credentials from other users due …
-
Medium 5.5
Mali GPU Kernel Driver exposes sensitive data from freed memory
A local non-privileged user can make GPU processing operations that expose sensitive data from previously freed memory.
-
Unscored —
In wifi service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial…
-
Unscored —
In wifi service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial…
-
Unscored —
In camera driver, there is a possible out of bounds write due to a incorrect bounds check. This could lead to local den…
-
Unscored —
In TeleService, there is a possible system crash due to improper input validation. This could lead to local denial of s…
-
Unscored —
In TeleService, there is a possible system crash due to improper input validation. This could lead to local denial of s…
-
Unscored —
In TeleService, there is a possible system crash due to improper input validation. This could lead to local denial of s…
-
Unscored —
In sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denia…
-
Unscored —
In RGXUnbackingZSBuffer of rgxta3d.c, there is a possible arbitrary code execution due to a use after free. This could …
-
Unscored —
In PMR_ReadBytes of pmr.c, there is a possible arbitrary code execution due to a use after free. This could lead to loc…
-
Unscored —
In DevmemIntMapPMR of devicemem_server.c, there is a possible arbitrary code execution due to a use after free. This co…
-
Unscored —
In DevmemIntAcquireRemoteCtx of devicemem_server.c, there is a possible arbitrary code execution due to a race conditio…
-
Unscored —
In PMRWritePMPageList of TBD, there is a possible out of bounds write due to an integer overflow. This could lead to lo…
-
Unscored —
In PMRChangeSparseMemOSMem of physmem_osmem_linux.c, there is a possible out of bounds write due to an incorrect bounds…
-
Unscored —
In HTBLogKM of htbserver.c, there is a possible information disclosure due to log information disclosure. This could le…
-
Unscored —
In PMRChangeSparseMemOSMem of physmem_osmem_linux.c, there is a possible out of bounds write due to an incorrect bounds…
-
Unscored —
In OSMMapPMRGeneric of pmr_os.c, there is a possible out of bounds write due to an uncaught exception. This could lead …
-
Unscored —
In multiple functions of KeyguardViewMediator.java, there is a possible way to bypass lockdown mode with screen pinning…
-
Unscored —
In registerPhoneAccount of TelecomServiceImpl.java, there is a possible way to reveal images from another user due to a…
-
Unscored —
In DevmemIntChangeSparse of devicemem_server.c, there is a possible out of bounds write due to an integer overflow. Thi…
-
Unscored —
In MMU_UnmapPages of mmu_common.c, there is a possible out of bounds read due to improper input validation. This could …
-
Unscored —
In RGXDestroyZSBufferKM of rgxta3d.c, there is a possible arbitrary code execution due to an uncaught exception. This c…
-
Unscored —
Mali GPU Userspace Driver can make an Out-of-Bounds access
Out-of-bounds Write vulnerability in Arm Ltd Midgard GPU Userspace Driver, Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a local non-privileged user to write a constant…
-
Unscored —
In audio, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of…
-
Unscored —
In decoder, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of …
-
Unscored —
In decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation …
-
Unscored —
In visitUris of Notification.java, there is a possible way to display images from another user due to a confused deputy…
-
Unscored —
In RGXDestroyHWRTData of rgxta3d.c, there is a possible arbitrary code execution due to an uncaught exception. This cou…
-
Unscored —
In visitUris of Notification.java, there is a possible cross-user media read due to Confused Deputy. This could lead to…
-
Unscored —
In saveToXml of PersistableBundle.java, invalid data could lead to local persistent denial of service with no additiona…
-
Unscored —
In forceReplaceShortcutInner of ShortcutPackage.java, there is a possible way to register unlimited packages due to a m…
-
Unscored —
In a2dp_vendor_opus_decoder_decode_packet of a2dp_vendor_opus_decoder.cc, there is a possible out of bounds write due t…
-
Unscored —
In injectSendIntentSender of ShortcutService.java, there is a possible background activity launch due to a permissions …
-
Unscored —
In multiple functions of btm_ble_gap.cc, there is a possible out of bounds write due to a logic error in the code. This…
-
Unscored —
In loadMediaDataInBgForResumption of MediaDataManager.kt, there is a possible way to view another user's images due to …
-
Unscored —
In modify_for_next_stage of fdt.rs, there is a possible way to render KASLR ineffective due to improperly used crypto. …
-
Unscored —
In parse_gap_data of utils.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to…
-
Unscored —CVE-2023-40084 Public exploit
In run of MDnsSdListener.cpp, there is a possible memory corruption due to a use after free. This could lead to local e…
-
Unscored —
In transcodeQ*ToFloat of btif_avrcp_audio_track.cc, there is a possible out of bounds write due to a missing bounds che…
-
Unscored —
In getCredentialManagerPolicy of DevicePolicyManagerService.java, there is a possible method for users to select creden…
-
Unscored —
In BTM_BleVerifySignature of btm_ble.cc, there is a possible way to bypass signature validation due to side channel inf…
-
Unscored —
In onTransact of IncidentService.cpp, there is a possible out of bounds write due to memory corruption. This could lead…
-
Unscored —
In verifyShortcutInfoPackage of ShortcutService.java, there is a possible way to see another user's image due to a conf…
-
Unscored —
In keyguardGoingAway of ActivityTaskManagerService.java, there is a possible lock screen bypass due to a missing permis…
-
Unscored —
In createDontSendToRestrictedAppsBundle of PendingIntentUtils.java, there is a possible background activity launch due …
-
Unscored —
In OpRecordAudioMonitor::onFirstRef of AudioRecordClient.cpp, there is a possible way to record audio from the backgrou…
-
Unscored —
In hasPermissionForActivity of PackageManagerHelper.java, there is a possible URI grant due to improper input validatio…
-
Unscored —
In mOnDone of NotificationConversationInfo.java, there is a possible way to access app notification data of another use…
-
Unscored —
In multiple locations, there is a possible way to corrupt memory due to a double free. This could lead to local escalat…
-
Unscored —
In multiple functions of btm_ble_gap.cc, there is a possible out of bounds write due to a missing bounds check. This co…
-
Unscored —
In fixUpIncomingShortcutInfo of ShortcutService.java, there is a possible way to view another user's image due to a con…
-
Unscored —
In CreateAudioBroadcast of broadcaster.cc, there is a possible out of bounds write due to a missing bounds check. This …
-
Unscored —
In CreateAudioBroadcast of broadcaster.cc, there is a possible out of bounds write due to a missing bounds check. This …
-
Unscored —CVE-2023-45777 Public exploit
In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to launch arbitrary activitie…
-
Unscored —CVE-2023-45779 Public exploit
In the APEX module framework of AOSP, there is a possible malicious update to platform components due to improperly use…
-
Unscored —
In parse_gap_data of utils.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to…
-
Unscored —CVE-2023-45866 Public exploit
Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encr…
Revision history
-
#3
Neue Updates von Ubuntu aufgenommen
-
#2
Aktive Ausnutzung gemeldet
-
#1
Initiale Fassung
References
-
Ubuntu Security Notice USN-6540-1 vom 2023-12-07
https://ubuntu.com/security/notices/USN-6540-1
-
CISA Known Exploited Vulnerabilities Catalog vom 2023-12-05
https://www.cisa.gov/news-events/alerts/2023/12/05/cisa-adds-four-known-exploited-vulnerabilities-catalog
-
Android Security Bulletin vom 2023-12-04
https://source.android.com/docs/security/bulletin/2023-12-01