Summary
Ein Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen, einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen preiszugeben oder andere nicht näher spezifizierte Angriffe durchzuführen.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 59
-
High 7.8CVE-2024-53197 Exploited
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configura…
KEV Apr 9, 2025 -
High 7.1CVE-2024-53150 Exploited
ALSA: usb-audio: Fix out of bounds reads when finding clock sources
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, wh…
KEV Apr 9, 2025 -
Critical 9.8
In multiple locations, there is a possible way to execute arbitrary code due to a logic error in the code. This could l…
-
Critical 9.8
In avdt_msg_ind of avdt_msg.cc, there is a possible memory corruption due to type confusion. This could lead to paired …
-
Critical 9.8
In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow.…
-
High 8.8
GPU DDK - PVRSRVRGXGetEnabledHWPerfBlocksKM off-by-one OOB write
Software installed and run as a non-privileged user may conduct improper GPU system calls resulting in platform instability and reboots.
-
High 8.2
Buffer Over-read in Data Network Stack & Connectivity
Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards.
-
High 8.1
GPU DDK - MLIST/PM render state buffers writable allowing arbitrary writes to kernel memory pages
Software installed and run as a non-privileged user may conduct improper GPU system calls to allow unprivileged access to arbitrary physical memory page.
-
High 8.1
GPU DDK - Duplicate calls to RGXCreateFreeList on the same reservation leads to GPU UAF
Software installed and run as a non-privileged user may conduct improper GPU system calls to achieve unauthorised reads and writes of physical memory from the GPU HW.
-
High 7.8
Use After Free in HLOS
Memory corruption while handling file descriptor during listener registration/de-registration.
-
High 7.8
GPU DDK - Security: Reference count overflow in pvr_sync_rollback_export_fence
Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.
-
High 7.8
In multiple functions of Permissions.java, there is a possible way to override the state of the user's location permiss…
-
High 7.8
In FuseDaemon.cpp, there is a possible out of bounds write due to memory corruption. This could lead to local escalatio…
-
High 7.8
vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans During loopback communication, a dangling pointer can be created in vsk->trans, potentially leading to a Use-After…
-
High 7.8
GPU DDK - rgxfw_pm_add_freelist_for_reconstruction OOB write
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to subvert reconstruction activities to trigger a write of data outside the Guest's virtualised GPU memory.
-
High 7.8
binder: fix node UAF in binder_add_freeze_work()
In the Linux kernel, the following vulnerability has been resolved: binder: fix node UAF in binder_add_freeze_work() In binder_add_freeze_work() we iterate over the proc->nodes with the proc->inner_lock held. However, this lock is temporarily dropped in order…
-
High 7.8
Use After Free in DSP Service
Memory corruption may occur while initiating two IOCTL calls simultaneously to create processes from two different threads.
-
High 7.8
In onCreate of ChooserActivity.java , there is a possible way to view other users' images due to a confused deputy. Thi…
-
High 7.8
In multiple locations, there is a possible confused deputy due to Intent Redirect. This could lead to local escalation …
-
High 7.8
In multiple locations, there is a possible way to mislead a user into approving an authentication prompt for one app wh…
-
High 7.8
In multiple locations, there is a possible way to reveal images across users due to improper input validation. This cou…
-
High 7.8
In resolveContentProvider of ComputerEngine.java, there is a possible way to access URIs across users due to a logic er…
-
High 7.8
In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible way to grant permissions to an app on …
-
High 7.8
In canForward of IntentForwarderActivity.java, there is a possible bypass of the cross profile intent filter most commo…
-
High 7.8
In handleKeyGestureEvent of PhoneWindowManager.java, there is a possible lock screen bypass due to a logic error in the…
-
High 7.8
In setMediaButtonReceiver of multiple files, there is a possible way to launch arbitrary activities from background due…
-
High 7.8
In afterKeyEventLockedInterruptable of InputDispatcher.cpp, there is a possible use after free. This could lead to loca…
-
High 7.7
Exposure of Sensitive System Information to an Unauthorized Control Sphere in KERNEL
Information disclosure while creating MQ channels.
-
High 7.5
Insufficient Granularity of Access Control in Core
Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP.
-
High 7.5
Buffer Over-read in WLAN Host
Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.
-
High 7.5
Buffer Over-read in WLAN Host
Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.
-
High 7.5
Buffer Over-read in WLAN Host
Transient DOS may occur while parsing EHT operation IE or EHT capability IE.
-
High 7.5
Buffer Over-read in WLAN Host Communication
Transient DOS may occur while parsing extended IE in beacon.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS may occur while parsing SSID in action frames.
-
High 7.5
In ParseTag of dng_ifd.cpp, there is a possible way to crash the image renderer due to a missing bounds check. This cou…
-
High 7.3
In multiple functions of ConnectionServiceWrapper.java, there is a possible way to retain a permission forever in the b…
-
High 7.3
In finishTransition of Transition.java, there is a possible way to bypass touch filtering restrictions due to a tapjack…
-
High 7.3
In multiple locations, there is a possible way to mislead the user into enabling malicious phone calls forwarding due t…
-
High 7.3
In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way to grant notification access above …
-
High 7.3
In onLastAccessedStackLoaded of ActionHandler.java , there is a possible way to bypass storage restrictions across apps…
-
High 7.1
Exposed Dangerous Method or Function in HLOS
Cryptographic issues while generating an asymmetric key pair for RKP use cases.
-
High 7.1
GPU DDK - Out of bounds read into fwlog due to unchecked loop bounds
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to read data outside the Guest's virtualised GPU memory.
-
High 7.1
GPU DDK - OOB read into fwlog due to unchecked block count
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to read data outside the Guest's virtualised GPU memory.
-
High 7.0CVE-2025-22442 Public exploit
In multiple functions of DevicePolicyManagerService.java, there is a possible way to install unauthorized applications …
-
Medium 6.8
In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of pr…
-
Medium 6.7
Use After Free in DSP Service
Memory corruption while processing multiple IOCTL calls from HLOS to DSP.
-
Medium 6.7
GPU DDK - rgxfw_kernel_CMD_DISABLE_ZSSTORE OOB write via ui32WriteOffsetOfDisableZSStore
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory.
-
Medium 6.7
In vdec, there is a possible permission bypass due to improper input validation. This could lead to local escalation of…
-
Medium 6.7
In notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due to improper input vali…
-
Medium 6.2
Weak Authentication in HLOS
Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling bypass.
-
Medium 6.0
In DA, there is a possible permission bypass due to a logic error. This could lead to local escalation of privilege, if…
-
Medium 5.9
Mali GPU Userspace Driver allows an Out-of-Bounds access
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to …
-
Medium 5.5
In showAvatarPicker of EditUserPhotoController.java, there is a possible cross user image leak due to a confused deputy…
-
Medium 5.5
In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused…
-
Medium 5.5
In contentDescForNotification of NotificationContentDescription.kt, there is a possible notification content leak throu…
-
Medium 5.5
In isInSignificantPlace of multiple files, there is a possible way to access sensitive information due to a missing per…
-
Medium 5.5
In multiple locations, there is a possible method for a malicious app to prevent dialing emergency services under limit…
-
Medium 5.3
In keymaster, there is a possible out of bounds read due to a missing bounds check. This could lead to local informatio…
-
Medium 4.4
GPU DDK - rgxfw_hwperf_config OOB read & write
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to write data outside the Guest's virtualised GPU memory.
Revision history
-
#5
Referenz(en) aufgenommen: EUVD-2025-210009, EUVD-2025-210008
-
#4
Referenz(en) aufgenommen: EUVD-2025-201787
-
#3
Referenz(en) aufgenommen: EUVD-2025-26586, EUVD-2024-54955, EUVD-2025-26580, EUVD-2025-26585, EUVD-2025-26590, EUVD-2025-26591, EUVD-2025-26595, EUVD-2025-26596, EUVD-2025-26581, EUVD-2024-54953, EUVD-2024-54954, EUVD-2024-54956, EUVD-2025-26582, EUVD-2025-26583, EUVD-2025-26584, EUVD-2025-26587, EUVD-2025-26588, EUVD-2025-26589, EUVD-2025-26592, EUVD-2025-26593, EUVD-2025-26594, EUVD-2025-26597
-
#2
Neue Updates von Amazon aufgenommen
-
#1
Initiale Fassung
References
-
Android Patchday April 2025 vom 2025-04-07
https://source.android.com/docs/security/bulletin/2025-04-01
-
Amazon Linux Security Advisory ALASLIVEPATCH-2025-225 vom 2025-04-29
https://alas.aws.amazon.com/AL2/ALASLIVEPATCH-2025-225.html