Summary
Ein anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 28
-
Critical 9.8
Buffer Copy Without Checking Size of Input in Data Modem
Memory corruption in Data Modem while verifying hello-verify message during the DTLS handshake.
-
High 8.8
In modem protocol, there is a possible out of bounds write due to a missing bounds check. This could lead to remote cod…
-
High 8.8
In wlan firmware, there is a possible out of bounds write due to improper input validation. This could lead to remote e…
-
High 8.4
Buffer Copy Without Checking Size of Input in SPS Applications
Memory corruption in SPS Application while requesting for public key in sorter TA.
-
High 8.4
Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in SPS-Applications
Memory corruption while processing finish_sign command to pass a rsp buffer.
-
High 8.4
Use After Free in Kernel
Memory corruption when there is failed unmap operation in GPU.
-
High 8.4
Use After Free in Kernel
Memory corruption in Kernel while handling GPU operations.
-
High 7.8
Buffer Over-read in Trusted Execution Environment
Memory corruption while processing buffer initialization, when trusted report for certain report types are generated.
-
High 7.8
In assertPackageWithSharedUserIdIsPrivileged of InstallPackageHelper.java, there is a possible execution of arbitrary a…
-
High 7.8
In migrateNotificationFilter of NotificationManagerService.java, there is a possible failure to persist notifications s…
-
High 7.5
Improper Release of Memory Before Removing Last Reference in Data Modem
Transient DOS while processing IE fragments from server during DTLS handshake.
-
High 7.5
Improper Release of Memory Before Removing Last Reference in Data Modem
Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers.
-
High 7.5
Reachable Assertion in Multi-Mode Call Processor
Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR.
-
High 7.5
Reachable Assertion in Multi-Mode Call Processor
Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16.
-
High 7.5
Improper Input Validation in Multi-Mode Call Processor
Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR.
-
High 7.5
Improper input validation in Multi-Mode Call Processor
Transient DOS while processing DL NAS Transport message when message ID is not defined in the 3GPP specification.
-
High 7.5
Incorrect Type Conversion or Cast in Multi-Mode Call Processor
Transient DOS while processing DL NAS TRANSPORT message with payload length 0.
-
High 7.5
Improper Input Validation in Multi-Mode Call Processor
Transient DOS while processing CAG info IE received from NW.
-
High 7.5
Improper input Validation in Multi-Mode Call Processor
Transient DOS while processing PDU Release command with a parameter PDU ID out of range.
-
High 7.3
Buffer Copy Without Checking Size of Input in Audio
Memory corruption while processing Codec2 during v13k decoder pitch synthesis.
-
High 7.0
In onCreate of WifiDialogActivity.java, there is a possible way to bypass the DISALLOW_ADD_WIFI_CONFIG restriction due …
-
Medium 5.9
In modem EMM, there is a possible system crash due to improper input validation. This could lead to remote denial of se…
-
Medium 5.9
In multiple functions of SnoozeHelper.java, there is a possible way to cause a boot loop due to resource exhaustion. Th…
-
Medium 5.6
In TBD of TBD, there is a possible confusion of OEM and DRM certificates due to improperly used crypto. This could lead…
-
Medium 5.5
In multiple functions of CompanionDeviceManagerService.java, there is a possible launch NotificationAccessConfirmationA…
-
Medium 5.5
In multiple functions of AppOpsService.java, there is a possible way to saturate the content of /data/system/appops_acc…
-
Medium 4.7
In multiple functions of SnoozeHelper.java, there is a possible persistent denial of service due to resource exhaustion…
-
Unscored —
In multiple functions of KeyguardViewMediator.java, there is a possible way to bypass lockdown mode with screen pinning…
Revision history
-
#1
Initiale Fassung
References
-
Android Patchday April 2024 vom 2024-04-01
https://source.android.com/docs/security/bulletin/2024-04-01