Summary
Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen oder seine Rechte zu erweitern.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 51
-
Critical 9.8
In attp_build_read_by_type_value_cmd of att_protocol.cc , there is a possible out of bounds write due to improper input…
-
Critical 9.8
In alac decoder, there is a possible information disclosure due to an incorrect bounds check. This could lead to remote…
-
Critical 9.3
Buffer copy without checking size of Input in Core
Memory corruption in Core while processing control functions.
-
High 8.8
In alac decoder, there is a possible out of bounds write due to an incorrect error handling. This could lead to remote …
-
High 8.6
Stack-based Buffer Overflow in WLAN HOST
Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE.
-
High 8.6
Use of Out-of-range Pointer Offset in WLAN HOST
Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point.
-
High 8.4
In startInstall of UpdateFetcher.java, there is a possible way to trigger a malicious config update due to a logic erro…
-
High 8.4
In multiple functions of ashmem-dev.cpp, there is a possible missing seal due to a heap buffer overflow. This could lea…
-
High 8.4
In injectInputEventToInputFilter of AccessibilityManagerService.java, there is a possible arbitrary input event injecti…
-
High 8.4
In removePersistentDot of SystemStatusAnimationSchedulerImpl.kt, there is a possible race condition due to a logic erro…
-
High 8.2
Buffer Copy Without Checking Size of Input in Modem
Information disclosure in Modem while processing SIB5.
-
High 7.8
Time-of-check Time-of-use (TOCTOU) Race Condition in Trusted Execution Environment
Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation.
-
High 7.8
Use of Out-of-range Pointer Offset in PCIe
Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
-
High 7.8
Use of out-of-range pointer offset in Video
Memory corruption when malformed message payload is received from firmware.
-
High 7.8
Mali GPU Kernel Driver allows improper GPU memory processing operations
Out-of-bounds Write vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. Depending on th…
-
High 7.8
In BackgroundLaunchProcessController, there is a possible way to launch arbitrary activity from the background due to B…
-
High 7.8
there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege…
-
High 7.5
In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of servi…
-
High 7.5
Improper Release of Memory Before Removing Last Reference in Multi-Mode Call Processor
Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage.
-
High 7.5
Improper Input Validation in Multi-Mode Call Processor
Transient DOS in Multi-Mode Call Processor while processing UE policy container.
-
High 7.5
NULL Pointer Dereference in WLAN Firmware
Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL.
-
High 7.5
Reachable Assertion in WLAN Firmware
Transient DOS while processing 11AZ RTT management action frame received through OTA.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS while parse fils IE with length equal to 1.
-
High 7.5CVE-2024-0040 Public exploit
In setParameter of MtpPacket.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead…
-
High 7.5
In Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of…
-
High 7.5
In mp3 decoder, there is a possible out of bounds write due to a race condition. This could lead to remote escalation o…
-
High 7.4
In onNullBinding of TileLifecycleManager.java, there is a possible way to launch an activity from the background due to…
-
High 7.4
In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to bypass the restrictions on …
-
High 7.3
Untrusted Pointer Dereference in Video
Memory corruption in video while parsing invalid mp2 clip.
-
High 7.3
Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in Video
Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size.
-
High 7.1
Buffer Over-read in Core
Transient DOS in Core when DDR memory check is called while DDR is not initialized.
-
High 7.1
In multiple files, there is a possible way to capture the device screen when disallowed by device policy due to a logic…
-
High 7.0
Mali GPU Kernel Driver allows improper GPU processing operations
Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper GPU processing operations to gain access to already freed memory. This issue affects Valhall GPU Kernel Driver: from r37p0 through r40p0.
-
High 7.0
Mali GPU Kernel Driver allows improper GPU memory processing operations
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper memory processing operations to exploit a software race condition. If the system’s memory is carefully pre…
-
Medium 6.8
In multiple locations, there is a possible way to request access to directories that should be hidden due to improper i…
-
Medium 6.7
Use of Out-of-range Pointer Offset in Audio
Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.
-
Medium 6.7
Buffer Copy Without Checking Size of Input in Audio
Memory corruption in Audio while processing IIR config data from AFE calibration block.
-
Medium 6.7
Buffer Copy Without Checking Size of Input in Audio
Memory corruption in Audio while processing the calibration data returned from ACDB loader.
-
Medium 6.7
Buffer Copy Without Checking Size of Input in HLOS
Memory corruption in HLOS while converting from authorization token to HIDL vector.
-
Medium 6.7
In keyInstall, there is a possible escalation of privilege due to type confusion. This could lead to local escalation o…
-
Medium 6.6
In da, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of pr…
-
Medium 6.1
Buffer Over-read in Audio
Information disclosure in Audio while accessing AVCS services from ADSP payload.
-
Medium 5.9
Configuration Issue in Core
Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.
-
Medium 5.5
Buffer Over-read in Audio
Transient DOS in Audio when invoking callback function of ASM driver.
-
Medium 5.5
In multiple files, there is a possible way that trimmed content could be included in PDF output due to a logic error in…
-
Medium 5.5CVE-2024-0030 Public exploit
In btif_to_bta_response of btif_gatt_util.cc, there is a possible out of bounds read due to an incorrect bounds check. …
-
Medium 5.3
In applyCustomDescription of SaveUi.java, there is a possible way to view other user's images due to a confused deputy.…
-
Low 3.3
In applyCustomDescription of SaveUi.java, there is a possible way to view images belonging to a different user due to a…
-
Unscored —
In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of servi…
-
Unscored —
In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of servi…
Revision history
-
#1
Initiale Fassung
References
-
Android Security Bulletin—February 2024 vom 2024-02-05
https://source.android.com/docs/security/bulletin/2024-02-01
-
Pixel Update Bulletin—February 2024 vom 2024-02-05
https://source.android.com/docs/security/bulletin/pixel/2024-02-01