Summary
Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen oder seine Rechte zu erweitern.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 61
-
Critical 9.8
In Modem IMS Stack, there is a possible out of bounds write due to a missing bounds check. This could lead to remote co…
-
Critical 9.8
Buffer Copy without Checking Size of Input in Data Modem
Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call.
-
Critical 9.3
Incorrect Type Conversion or Cast in Core
Memory Corruption in Core due to incorrect type conversion or cast in secure_io_read/write function in TEE.
-
Critical 9.3
Buffer Copy without Checking Size of Input in HLOS
Memory corruption in HLOS while running playready use-case.
-
Critical 9.3
Integer Overflow or Wraparound in TZ Secure OS
Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.
-
High 8.4
Improper validation of array index in WLAN HAL
Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range.
-
High 8.4
In DevmemIntUnmapPMR of devicemem_server.c, there is a possible arbitrary code execution due to a use after free. This …
-
High 8.4
Use of Out-of-range Pointer Offset in Audio
Memory corruption in Audio during playback with speaker protection.
-
High 8.4
Use After Free in Linux Graphics
Memory corruption while running VK synchronization with KASAN enabled.
-
High 8.4
Use After Free in Graphics
Memory corruption in Graphics Driver when destroying a context with KGSL_GPU_AUX_COMMAND_TIMELINE objects queued.
-
High 8.4
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Kernel
Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.
-
High 8.4
Use after free in Neural Processing Unit
Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time.
-
High 8.4
Use After Free in DSP Services
Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP.
-
High 8.4
In convertYUV420Planar16ToY410 of ColorConverter.cpp, there is a possible out of bounds write due to a heap buffer over…
-
High 7.8
In showNextSecurityScreenOrFinish of KeyguardSecurityContainerController.java, there is a possible way to access the lo…
-
High 7.8
Buffer Copy without Checking the Size of Input in WLAN Firmware
Memory corruption in WLAN while sending transmit command from HLOS to UTF handlers.
-
High 7.8
Improper Validation of Array Index in WLAN HAL
Memory corruption in WLAN HAL while processing Tx/Rx commands from QDART.
-
High 7.8
Improper Validation of Array Index in WLAN HAL
Memory corruption in WLAN HAL while processing command parameters from untrusted WMI payload.
-
High 7.8
Improper Validation of Array Index in WLAN HAL
Memory corruption in WLAN handler while processing PhyID in Tx status handler.
-
High 7.8
Buffer Copy Without Checking Size of Input in WLAN HAL
Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload.
-
High 7.8
Buffer Copy Without Checking Size of Input in WLAN HAL
Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.
-
High 7.8
Use of Out-of-range Pointer Offset in WLAN HAL
Memory corruption in WLAN HAL while passing command parameters through WMI interfaces.
-
High 7.8
Improper Validation of Array Index in WLAN HAL
Memory corruption in WLAN HAL while handling command streams through WMI interfaces.
-
High 7.8
Improper Validation of Array Index in WLAN HAL
Memory corruption in WLAN HAL while handling command through WMI interfaces.
-
High 7.8
Use of Out-of-range Pointer Offset in Audio
The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory cor…
-
High 7.8
Use After Free in Audio
Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command.
-
High 7.8
Use After Free in Audio
Memory corruption in Audio when memory map command is executed consecutively in ADSP.
-
High 7.8
Mali GPU Kernel Driver allows improper GPU memory processing operations
A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.
-
High 7.8
Mali GPU Kernel Driver allows improper GPU processing operations
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU processing operations to gain access to already fr…
-
High 7.8CVE-2024-0015 Public exploit
In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to…
-
High 7.6
Improper Input Validation in Services
Information disclosure in Core services while processing a Diag command.
-
High 7.5
Buffer Over-read in Data Modem
Transient DOS in Data Modem during DTLS handshake.
-
High 7.5
Reachable Assertion in Modem
Transient DOS in Modem when a Beam switch request is made with a non-configured BWP.
-
High 7.5
Reachable Assertion in Data Modem
Transient DOS in Data modem while handling TLB control messages from the Network.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN Firmware while parsing a BTM request.
-
High 7.5
NULL Pointer Dereference in WLAN Firmware
Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element.
-
High 7.5
Loop with Unreachable Exit Condition (Infinite Loop) in WLAN Firmware
Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.
-
High 7.4CVE-2024-0023 Public exploit
In ConvertRGBToPlanarYUV of Codec2BufferUtils.cpp, there is a possible out of bounds write due to an incorrect bounds c…
-
High 7.1
NULL Pointer Dereference in Hypervisor
Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call.
-
High 7.1
Cryptographic Issues in Automotive
Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data.
-
High 7.0
In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way for an app in the work profile to e…
-
Medium 6.7
Double Free in Data Network Stack & Connectivity
Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address.
-
Medium 6.7
In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalati…
-
Medium 6.7
Integer Overflow or Wraparound in Radio Interface Layer
Memory corruption while receiving a message in Bus Socket Transport Server.
-
Medium 6.5
In multiple locations, there is a possible out of bounds read due to a missing bounds check. This could lead to paired …
-
Medium 6.2
In setListening of AppOpsControllerImpl.java, there is a possible way to hide the microphone privacy indicator when res…
-
Medium 5.5
Improper Validation of Array Index in Audio
Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command.
-
Medium 5.5
In video decoder, there is a possible out of bounds write due to improper input validation. This could lead to local de…
-
Medium 5.5
In video decoder, there is a possible out of bounds read due to improper input validation. This could lead to local den…
-
Medium 5.5
In video decoder, there is a possible out of bounds write due to improper input validation. This could lead to local de…
-
Medium 5.5
In video decoder, there is a possible out of bounds read due to improper input validation. This could lead to local den…
-
Medium 5.5
In video decoder, there is a possible out of bounds write due to improper input validation. This could lead to local de…
-
Medium 5.5
In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local denia…
-
Medium 5.5
In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local denia…
-
Medium 5.5
In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local denia…
-
Medium 5.5
In phasecheckserver, there is a possible out of bounds write due to a missing bounds check. This could lead to local de…
-
Medium 5.5
In shouldUseNoOpLocation of CameraActivity.java, there is a possible confused deputy due to a permissions bypass. This …
-
Medium 5.5
In onActivityResult of NotificationSoundPreference.java, there is a possible way to hear audio files belonging to a dif…
-
Medium 4.4
In media service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denia…
-
Low 3.3
In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. T…
Revision history
-
#2
Neue Updates aufgenommen
-
#1
Initiale Fassung
References
-
Android Security Bulletin vom 2024-01-03
https://source.android.com/docs/security/bulletin/2024-01-01
-
Pixel-Update-Bulletin vom 2024-01-03
https://source.android.com/docs/security/bulletin/pixel/2024-01-01
-
Samsung Security Update vom 2024-01-03
https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=01
-
Lancom Allgemeine Sicherheitshinweise vom 2024-06-04
https://www.lancom-systems.de/service-support/allgemeine-sicherheitshinweise