Summary
Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Samsung Android ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder seine Rechte zu erweitern.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 39
-
Critical 9.8CVE-2024-0039 Public exploit
In attp_build_value_cmd of att_protocol.cc, there is a possible out of bounds write due to a missing bounds check. This…
-
Critical 9.8
In alac decoder, there is a possible information disclosure due to an incorrect bounds check. This could lead to remote…
-
Critical 9.3
Buffer copy without checking size of Input in Core
Memory corruption in Core while processing control functions.
-
Critical 9.1
In access_secure_service_from_temp_bond of btm_sec.cc, there is a possible way to achieve keystroke injection due to im…
-
High 8.6
Stack-based Buffer Overflow in WLAN HOST
Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE.
-
High 8.6
Use of Out-of-range Pointer Offset in WLAN HOST
Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point.
-
High 8.4
In Session of AccountManagerService.java, there is a possible method to retain foreground service privileges due to inc…
-
High 8.2
Buffer Copy Without Checking Size of Input in Modem
Information disclosure in Modem while processing SIB5.
-
High 7.8
Time-of-check Time-of-use (TOCTOU) Race Condition in Trusted Execution Environment
Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation.
-
High 7.8
Use of Out-of-range Pointer Offset in PCIe
Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
-
High 7.8
Use of out-of-range pointer offset in Video
Memory corruption when malformed message payload is received from firmware.
-
High 7.8
Mali GPU Kernel Driver allows improper GPU memory processing operations
Out-of-bounds Write vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. Depending on th…
-
High 7.8CVE-2024-0044 Public exploit
In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input vali…
-
High 7.8
In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a l…
-
High 7.8
In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local …
-
High 7.8
In onQueueFilled of SoftMPEG4.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could le…
-
High 7.5
In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of servi…
-
High 7.5
Improper Release of Memory Before Removing Last Reference in Multi-Mode Call Processor
Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage.
-
High 7.5
Improper Input Validation in Multi-Mode Call Processor
Transient DOS in Multi-Mode Call Processor while processing UE policy container.
-
High 7.5
NULL Pointer Dereference in WLAN Firmware
Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL.
-
High 7.5
Reachable Assertion in WLAN Firmware
Transient DOS while processing 11AZ RTT management action frame received through OTA.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS while parse fils IE with length equal to 1.
-
High 7.5
In smp_proc_sec_req of smp_act.cc, there is a possible out of bounds read due to improper input validation. This could …
-
High 7.5
In Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of…
-
High 7.5
In mp3 decoder, there is a possible out of bounds write due to a race condition. This could lead to remote escalation o…
-
High 7.1
Buffer Over-read in Core
Transient DOS in Core when DDR memory check is called while DDR is not initialized.
-
High 7.1
In getConfig of SoftVideoDecoderOMXComponent.cpp, there is a possible out of bounds write due to a missing validation c…
-
High 7.0
Mali GPU Kernel Driver allows improper GPU processing operations
Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper GPU processing operations to gain access to already freed memory. This issue affects Valhall GPU Kernel Driver: from r37p0 through r40p0.
-
High 7.0
Mali GPU Kernel Driver allows improper GPU memory processing operations
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper memory processing operations to exploit a software race condition. If the system’s memory is carefully pre…
-
Medium 6.7
In keyInstall, there is a possible escalation of privilege due to type confusion. This could lead to local escalation o…
-
Medium 6.2
In multiple functions of healthconnect, there is a possible leakage of exercise route data due to a missing permission …
-
Medium 5.9
Configuration Issue in Core
Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.
-
Medium 5.5
In writeUserLP of UserManagerService.java, device policies are serialized with an incorrect tag due to a logic error in…
-
Low 3.3
In getCustomPrinterIcon of PrintManagerService.java, there is a possible way to view other user's images due to a confu…
-
Unscored —
In onCreate of NotificationAccessSettings.java, there is a possible failure to persist notifications settings due to im…
-
Unscored —
In launchConfirmationActivity of ChooseLockSettingsHelper.java, there is a possible way to enable developer options wit…
-
Unscored —
In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of servi…
-
Unscored —
In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of servi…
Revision history
-
#1
Initiale Fassung
References
-
Samsung Security Update vom 2024-03-04
https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=03