Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android Pixel ausnutzen, um beliebigen Code auszuführen, an vertrauliche Informationen zu gelangen, das System zum Absturz zu bringen (Denial-of-Service-Zustand) und seine Rechte zu erhöhen.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 33
-
High 7.8
In gpu_pixel_handle_buffer_liveness_update_ioctl of private/google-modules/gpu/mali_kbase/platform/pixel/pixel_gpu_slc.…
-
High 7.5
Reachable assertion in WLAN Firmware
Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids.
-
High 7.5
In ProtocolNetAcBarringInfo::ProtocolNetAcBarringInfo() of protocolnetadapter.cpp, there is a possible out of bounds re…
-
High 7.1
An issue was discovered in Samsung Mobile Processor, Wearable Processor, Automotive Processor, and Modem (Exynos 9810, …
-
Medium 6.7
Improper Restriction of Operations within the Bounds of a Memory Buffer in Radio Interface Layer
Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM.
-
Medium 6.7
Use After Free in Camera
Memory Corruption in camera while installing a fd for a particular DMA buffer.
-
Medium 6.7
Use After Free in Audio
Memory Corruption in Audio while invoking IOCTLs calls from the user-space.
-
Medium 6.7
Multiple Type Confusion Vulnerability
The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it.
-
Medium 6.7
Buffer Copy Without Checking Size of Input in WLAN Host
Memory Corruption in WLAN Host while deserializing the input PMK bytes without checking the input PMK length.
-
Medium 6.7
Buffer Copy Without Checking Size of Input in WLAN Host
Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache.
-
Medium 6.7
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Radio Interface Layer
Memory corruption while sending SMS from AP firmware.
-
Low 2.8
An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem Exynos 9810, Exynos 9610, E…
-
Unscored —
In Init of protocolcalladapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could le…
-
Unscored —
In ProtocolMiscATCommandAdapter::Init() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a mis…
-
Unscored —
In GetSizeOfEenlRecords of protocoladapter.cpp, there is a possible out of bounds read due to an incorrect bounds check…
-
Unscored —
In ppcfw_enable of ppcfw.c, there is a possible EoP due to a missing permission check. This could lead to local escalat…
-
Unscored —
In sms_DecodeCodedTpMsg of sms_PduCodec.c, there is a possible out of bounds read due to a heap buffer overflow. This c…
-
Unscored —
In ProtocolMiscCarrierConfigSimInfoIndAdapter of protocolmiscadapter.cpp, there is a possible out of bounds read due to…
-
Unscored —
there is a possible way for the secure world to write to NS memory due to a logic error in the code. This could lead to…
-
Unscored —
there is a possible permanent DoS or way for the modem to boot unverified firmware due to a logic error in the code. Th…
-
Unscored —
there is a possible DCK won't be deleted after factory reset due to a logic error in the code. This could lead to local…
-
Unscored —
In ProtocolNetSimFileInfoAdapter() of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing b…
-
Unscored —
In gpu_pixel_handle_buffer_liveness_update_ioctl of private/google-modules/gpu/mali_kbase/mali_kbase_core_linux.c, ther…
-
Unscored —
In cd_ParseMsg of cd_codec.c, there is a possible out of bounds read due to a missing bounds check. This could lead to …
-
Unscored —
In SignalStrengthAdapter::FillGsmSignalStrength() of protocolmiscadapter.cpp, there is a possible out of bounds read du…
-
Unscored —
In private_handle_t of mali_gralloc_buffer.h, there is a possible information leak due to a logic error in the code. Th…
-
Unscored —
In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lea…
-
Unscored —
In the Pixel Camera Driver, there is a possible use after free due to a logic error in the code. This could lead to loc…
-
Unscored —
In Init of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could l…
-
Unscored —
In multiple locations, there is a possible null dereference due to a missing null check. This could lead to remote deni…
-
Unscored —
there is a possible use after free due to a race condition. This could lead to local escalation of privilege with Syste…
-
Unscored —
In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lea…
-
Unscored —
In dhcp4_SetPDNAddress of dhcp4_Main.c, there is a possible out of bounds write due to a missing bounds check. This cou…
Revision history
-
#1
Initiale Fassung
References
-
Pixel Update Bulletin vom 2023-12-06
https://source.android.com/docs/security/bulletin/pixel/2023-12-01