Summary
Ein Angreifer kann mehrere Schwachstellen in Google Android und Pixel ausnutzen, um seine Privilegien zu erhöhen, beliebigen Programmcode auszuführen, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 92
-
Critical 9.8
Use After Free in WLAN Host Communication
Memory corruption while processing MBSSID beacon containing several subelement IE.
-
Critical 9.8
Use of Out-of-range Pointer Offset in WLAN HOST
Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.
-
Critical 9.8
U-Boot shell vulnerability resulting in Privilege escalation in a production device
-
Critical 9.8
-
Critical 9.8CVE-2024-0039 Public exploit
In attp_build_value_cmd of att_protocol.cc, there is a possible out of bounds write due to a missing bounds check. This…
-
Critical 9.8
A malicious DNS response can trigger a number of OOB reads, writes, and other memory issues
-
Critical 9.8
there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no…
-
Critical 9.3
Improper Input Validation in Services
Memory corruption in Core Services while executing the command for removing a single event listener.
-
Critical 9.1
In access_secure_service_from_temp_bond of btm_sec.cc, there is a possible way to achieve keystroke injection due to im…
-
Critical 9.1
Exported broadcast receivers allowing malicious apps to bypass broadcast protection.
-
High 8.4
Use of Out-of-range Pointer Offset in Audio
Memory corruption in Audio while processing RT proxy port register driver.
-
High 8.4
Use After Free in Automotive Multimedia
Memory corruption while invoking HGSL IOCTL context create.
-
High 8.4
Use After Free in Automotive Multimedia
Memory corruption while invoking IOCTLs calls in Automotive Multimedia.
-
High 8.4
Stack-based Buffer Overflow in WLAN HAL
Memory corruption while processing TPC target power table in FTM TPC.
-
High 8.4
A vulnerability was discovered in Samsung Mobile Processor, Wearable Processor, and Modems with versions Exynos 9820, E…
-
High 8.4
Mali GPU Kernel Driver allows improper GPU memory processing operations
Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to exploit a software race condition…
-
High 8.4
In Session of AccountManagerService.java, there is a possible method to retain foreground service privileges due to inc…
-
High 8.4
there is a possible Authentication Bypass due to improperly used crypto. This could lead to local escalation of privile…
-
High 8.4
In bigo_unlocked_ioctl of bigo.c, there is a possible UAF due to a missing bounds check. This could lead to local escal…
-
High 8.4
In SAEMM_DiscloseGuti of SAEMM_RadioMessageCodec.c, there is a possible out of bounds read due to a missing bounds chec…
-
High 8.4
In tmu_reset_tmu_trip_counter of , there is a possible out of bounds write due to a missing bounds check. This could le…
-
High 8.4
In tmu_set_gov_active of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead …
-
High 8.4
there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no…
-
High 8.4
there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege…
-
High 8.4
there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege…
-
High 8.4
In BroadcastSystemMessage of servicemgr.cpp, there is a possible Remote Code Execution due to a use after free. This co…
-
High 8.4
In tmu_set_pi of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local…
-
High 8.4
In lpm_req_handler of , there is a possible out of bounds memory access due to a missing bounds check. This could lead …
-
High 8.4
In tmu_config_gov_params of , there is a possible out of bounds write due to a missing bounds check. This could lead to…
-
High 8.4
In aoc_unlocked_ioctl of aoc.c, there is a possible memory corruption due to type confusion. This could lead to local e…
-
High 8.2
In da, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of …
-
High 8.1
A vulnerability was discovered in Samsung Mobile Processor, Wearable Processor, and Modems with versions Exynos 9820, E…
-
High 8.1
A vulnerability was discovered in Samsung Wearable Processor and Modems with versions Exynos 9110, Exynos Modem 5123, E…
-
High 7.9
In da, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of…
-
High 7.8
Integer Overflow or Wraparound in Core Services
Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem.
-
High 7.8CVE-2023-6241 Public exploit
Mali GPU Kernel Driver allows improper GPU memory processing operations
Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to exploit a software race condition…
-
High 7.8CVE-2024-0044 Public exploit
In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input vali…
-
High 7.8
In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a l…
-
High 7.8
In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local …
-
High 7.8
In onQueueFilled of SoftMPEG4.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could le…
-
High 7.8
In config_gov_time_windows of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could …
-
High 7.8
In ppmp_unprotect_buf of drm_fw.c, there is a possible compromise of protected memory due to a logic error in the code.…
-
High 7.8
In tmu_tz_control of tmu.c, there is a possible out of bounds read due to a missing bounds check. This could lead to lo…
-
High 7.8
In policy_check of fvp.c, there is a possible out of bounds write due to a missing bounds check. This could lead to loc…
-
High 7.8
In init_data of , there is a possible out of bounds write due to a missing bounds check. This could lead to local escal…
-
High 7.8
In update_policy_data of , there is a possible out of bounds write due to a missing bounds check. This could lead to lo…
-
High 7.8
In onSkipButtonClick of FaceEnrollFoldPage.java, there is a possible way to access the file the app cannot access due t…
-
High 7.8
In strncpy of strncpy.c, there is a possible out of bounds write due to a missing bounds check. This could lead to loca…
-
High 7.8
In ppcfw_init_secpolicy of ppcfw.c, there is a possible permission bypass due to uninitialized data. This could lead to…
-
High 7.7
In AtiHandleAPOMsgType of ati_Main.c, there is a possible OOB write due to a missing null check. This could lead to loc…
-
High 7.5
Improper Input Validation in Modem
Transient DOS in Modem after RRC Setup message is received.
-
High 7.5CVE-2023-33105 Public exploit
Configuration Issue in WLAN Host and Firmware
Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent with an invalid transaction sequence number.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame.
-
High 7.5
In smp_proc_sec_req of smp_act.cc, there is a possible out of bounds read due to improper input validation. This could …
-
High 7.5
In ss_ProcessRejectComponent of ss_MmConManagement.c, there is a possible out of bounds read due to a missing bounds ch…
-
High 7.5
there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure …
-
High 7.5
In ss_SendCallBarringPwdRequiredIndMsg of ss_CallBarring.c, there is a possible null pointer deref due to a missing nul…
-
High 7.3
Buffer Copy Without Checking Size of Input in Video
Memory corruption while parsing qcp clip with invalid chunk data size.
-
High 7.1
In getConfig of SoftVideoDecoderOMXComponent.cpp, there is a possible out of bounds write due to a missing validation c…
-
High 7.1
In init_data of , there is a possible out of bounds write due to a missing bounds check. This could lead to local escal…
-
Medium 6.7
In lk, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation o…
-
Medium 6.7
In flashc, there is a possible out of bounds write due to lack of valudation. This could lead to local escalation of pr…
-
Medium 6.7
In da, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privi…
-
Medium 6.7
In pt_sysctl_command of pt.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead…
-
Medium 6.6
In da, there is a possible out of bounds write due to lack of valudation. This could lead to local escalation of privil…
-
Medium 6.4
In pktproc_perftest_gen_rx_packet_sktbuf_mode of link_rx_pktproc.c, there is a possible out of bounds write due to a ra…
-
Medium 6.2
In multiple functions of healthconnect, there is a possible leakage of exercise route data due to a missing permission …
-
Medium 6.2
In constraint_check of fvp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to …
-
Medium 6.2
In dumpBatteryDefend of dump_power.cpp, there is a possible out of bounds read due to a heap buffer overflow. This coul…
-
Medium 6.2
In update_freq_data of , there is a possible out of bounds read due to a missing bounds check. This could lead to local…
-
Medium 6.0
In flashc, there is a possible out of bounds write due to lack of valudation. This could lead to local escalation of pr…
-
Medium 5.9
An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem (Exynos Mobile Processor, A…
-
Medium 5.9
In gpu_slc_liveness_update of pixel_gpu_slc.c, there is a possible out of bounds read due to a missing bounds check. Th…
-
Medium 5.9
In fvp_set_target of fvp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to lo…
-
Medium 5.5
Buffer Over-read in Audio
Transient DOS while processing channel information for speaker protection v2 module in ADSP.
-
Medium 5.5
In writeUserLP of UserManagerService.java, device policies are serialized with an incorrect tag due to a logic error in…
-
Medium 5.5
In dvfs_plugin_caller of fvp.c, there is a possible out of bounds read due to a missing bounds check. This could lead t…
-
Medium 5.5
In plugin_extern_func of , there is a possible out of bounds read due to a missing bounds check. This could lead to loc…
-
Medium 5.5
In wipe_ns_memory of nsmemwipe.c, there is a possible incorrect size calculation due to a logic error in the code. This…
-
Medium 5.3
An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 850, …
-
Medium 5.3
OOB read in the TMU plugin that allows for memory disclosure in the power management subsystem of the device.
-
Medium 5.1
Buffer Over-read in DSP Services
Information Disclosure while processing IOCTL request in FastRPC.
-
Medium 5.1
In EUTRAN_LCS_DecodeFacilityInformationElement of LPP_LcsManagement.c, there is a possible out of bounds read due to a …
-
Medium 5.1
In ProtocolPsKeepAliveStatusAdapter::getCode() of protocolpsadapter.cpp, there is a possible out of bounds read due to …
-
Medium 4.4
In OPTEE, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local informatio…
-
Medium 4.4
In sendHciCommand of bluetooth_hci.cc, there is a possible out of bounds read due to a heap buffer overflow. This could…
-
Medium 4.2
In da, there is a possible information disclosure due to improper input validation. This could lead to local informatio…
-
Low 3.7
An issue was discovered in Samsung Mobile Processor, and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos…
-
Low 3.3
In getCustomPrinterIcon of PrintManagerService.java, there is a possible way to view other user's images due to a confu…
-
Low 3.3
In acpm_tmu_ipc_handler of tmu_plugin.c, there is a possible out of bounds read due to a missing bounds check. This cou…
-
Unscored —
An issue was discovered in Samsung Exynos Mobile Processor and Wearable Processor 9810, 9610, 9820, 980, 850, 1080, 210…
-
Unscored —
In loadMediaDataInBgForResumption of MediaDataManager.kt, there is a possible way to view another user's images due to …
Revision history
-
#2
Neue Updates aufgenommen
-
#1
Initiale Fassung
References
-
Android Security Bulletin—March 2024 vom 2024-03-04
https://source.android.com/docs/security/bulletin/2024-03-01
-
Pixel Update Bulletin—March 2024 vom 2024-03-04
https://source.android.com/docs/security/bulletin/pixel/2024-03-01
-
Lancom Allgemeine Sicherheitshinweise vom 2024-06-04
https://www.lancom-systems.de/service-support/allgemeine-sicherheitshinweise