Summary
Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen, einen Denial-of-Service-Zustand zu erzeugen oder vertrauliche Informationen offenzulegen.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 35
-
High 8.1CVE-2024-32896 Exploited
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege wi…
KEV Jun 13, 2024 -
High 8.4
Use After Free in SCE-Mink
Memory corruption while releasing shared resources in MinkSocket listener thread.
-
High 8.4
In PVRSRVBridgeRGXKickTA3D2 of server_rgxta3d_bridge.c, there is a possible arbitrary code execution due to improper in…
-
High 8.4
Use After Free in Graphics Linux
Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time.
-
High 8.4
Integer Overflow or Wraparound in Display
Memory corruption while calculating total metadata size when a very high reserved size is requested by gralloc clients.
-
High 8.4
Return of Stack Variable Address in Buses
Memory corruption when BTFM client sends new messages over Slimbus to ADSP.
-
High 8.4
Use After Free in DSP Service
Memory corruption when two threads try to map and unmap a single node simultaneously.
-
High 8.3
In UMTS RLC driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote de…
-
High 8.3
In UMTS RLC driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote den…
-
High 8.2
Buffer Over-read in Multi Mode Call Processor
Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.
-
High 7.8
Untrusted Pointer Dereference in Computer Vision
Memory corruption while passing untrusted/corrupted pointers from DSP to EVA.
-
High 7.8
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host
Memory corruption when Alternative Frequency offset value is set to 255.
-
High 7.8
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host
Memory corruption when user provides data for FM HCI command control operations.
-
High 7.8
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Computer Vision
Memory corruption during the handshake between the Primary Virtual Machine and Trusted Virtual Machine.
-
High 7.8
Mali GPU Kernel Driver allows improper GPU memory processing operations
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to alr…
-
High 7.8
af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock.
In the Linux kernel, the following vulnerability has been resolved: af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock. Billy Jheng Bing-Jhong reported a race between __unix_gc() and queue_oob(). __unix_gc() tries to garbage-collect close()d inf…
-
High 7.8
In wifi_item_edit_content of styles.xml , there is a possible FRP bypass due to Missing check for FRP state. This could…
-
High 7.8
In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalat…
-
High 7.8
In bindAndGetCallIdentification of CallScreeningServiceHelper.java, there is a possible way to maintain a while-in-use …
-
High 7.8
In addPreferencesForType of AccountTypePreferenceLoader.java, there is a possible way to disable apps for other users d…
-
High 7.8
In getConfig of SoftVideoDecoderOMXComponent.cpp, there is a possible out of bounds write due to a heap buffer overflow…
-
High 7.8
In scheme of Uri.java, there is a possible way to craft a malformed Uri object due to improper input validation. This c…
-
High 7.5
Buffer Over-read in Multi Mode Call Processor
Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in Modem.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of a beacon frame that is received from over-the-air (OTA).
-
High 7.5
Buffer Over-read in WLAN Host
Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
-
High 7.5
Buffer Over-read in WLAN Host Communication
Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
-
High 7.5
Buffer Over-read in WLAN Host Communication
Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.
-
High 7.4
In DevmemIntPFNotify of devicemem_server.c, there is a possible use-after-free due to a race condition. This could lead…
-
High 7.3
In onCreate of SettingsHomepageActivity.java, there is a possible way to access the Settings app while the device is pr…
-
High 7.1
Improper Input Validation in Trusted Execution Environment
Cryptographic issue while parsing RSA keys in COBR format.
-
Medium 6.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage
memory corruption when an invalid firehose patch command is invoked.
-
Medium 5.5
Buffer Over-read in FM Host
Transient DOS while handling PS event when Program Service name length offset value is set to 255.
-
Medium 5.5
In handleCreateConferenceComplete of ConnectionServiceWrapper.java, there is a possible way to reveal images across use…
-
Medium 5.5
In getRegistration of RemoteProvisioningService.java, there is a possible way to permanently disable the AndroidKeyStor…
Revision history
-
#1
Initiale Fassung
References
-
Android Patchday September vom 2024-09-03
https://source.android.com/docs/security/bulletin/2024-09-01