Summary
Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen oder vertrauliche Informationen offenlegen.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 26
-
Critical 9.8
In multiple locations, there is a possible failure to persist or enforce user restrictions due to improper input valida…
-
Critical 9.8CVE-2024-23708 Public exploit
In multiple functions of NotificationManagerService.java, there is a possible way to not show a toast message when a cl…
-
High 8.4
Time-of-check Time-of-use (TOCTOU) Race Condition in Hypervisor
Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache.
-
High 8.4
Access of Uninitialized Pointer in SPS Applications
Memory corruption while verifying the serialized header when the key pairs are generated.
-
High 8.4
Use After Free in Graphics Linux
Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.
-
High 8.4
Improper Access Control in Graphics Linux
Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions.
-
High 8.4
Use After Free in Graphics Linux
Memory corruption when the IOCTL call is interrupted by a signal.
-
High 7.8CVE-2023-4622 Public exploit
Use-after-free in Linux kernel's af_unix component
A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there…
-
High 7.8
In multiple methods of UserManagerService.java, there is a possible failure to persist or enforce user restrictions due…
-
High 7.8
In sendIntentSender of ActivityManagerService.java, there is a possible background activity launch due to a logic error…
-
High 7.8
In multiple locations, there is a possible notification listener grant to an app running in the work profile due to a l…
-
High 7.8
Use of Out-of-range Pointer Offset in Video
Memory corruption when the payload received from firmware is not as per the expected protocol size.
-
High 7.8
In multiple locations, there is a possible permissions bypass due to improper input validation. This could lead to loca…
-
High 7.5
Reachable Assertion in Data Modem
Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame.
-
High 7.4
Mali GPU Kernel Driver allows improper GPU memory processing operations
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. On Armv8.0 cores, th…
-
High 7.4
In multiple locations, there is a possible bypass of health data permissions due to an improper input validation. This …
-
High 7.3
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio
Memory corruption while playing audio file having large-sized input buffer.
-
High 7.2
In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalati…
-
Medium 6.7
Mali GPU Kernel Driver allows improper GPU memory processing operations
Use After Free vulnerability in Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. If the system’s memory is carefully prepared by the user, then this in turn could give the…
-
Medium 6.7
In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local es…
-
Medium 6.5CVE-2024-23709 Public exploit
In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote…
-
Medium 6.4
In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalati…
-
Medium 5.9
Integer Overflow or Wraparound in HLOS
Memory corruption in HLOS while checking for the storage type.
-
Medium 5.3
In DA, there is a possible permission bypass due to an incorrect status check. This could lead to local escalation of p…
-
Medium 5.1
Mali GPU Kernel Driver allows improper GPU processing operations
Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. If the system’s memory is carefully prepared by the use…
Revision history
-
#2
Neue Updates von openSUSE aufgenommen
-
#1
Initiale Fassung
References
-
Android Patchday May 2024 vom 2024-05-06
https://source.android.com/docs/security/bulletin/2024-05-01
-
openSUSE Security Update OPENSUSE-SU-2024:14401-1 vom 2024-10-15
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/EWEL2DDPI3THPULGLN7MWENZEFZGVJQW/