2,761 results · Feed
-
Unscored —
In multiple locations, there is a possible way to trigger an out of bounds read via an attestation comparison oracle du…
-
Unscored —
In port_shutdown of ipc.c, there is a possible Use After Free due to a race condition. This could lead to local escalat…
-
Unscored —
In km_os_regen_salt of storage.c, there is a possible way to recover deleted keys due to a logic error. This could lead…
-
Unscored —
In arm_lpae_split_blk_unmap of drivers/iommu/io-pgtable-arm-common.c, there is a possible Logic error due to a logic er…
-
Unscored —
In RecordApTx of efw_ap_transport.c, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could …
-
Unscored —
In TrustyKeyMintManager::VerifyHat of trusty_keymint_manager.cc, there is a possible Security check bypass due to a log…
-
Unscored —
In smmu_find_ste of smmu.c, there is a possible way to retain stale translation lookaside buffer entries across stream …
-
Unscored —
In multiple functions of PssSubscriptionManager.java, there is a possible way to spoof subscription switch results and …
-
Unscored —
In PackageSignatureChecker of SystemUIGoogleModule.java, there is a possible background activity launch due to a confus…
-
Unscored —
In _vqueue_get_avail_buf_locked of trusty/kernel/lib/trusty/vqueue.c, there is a possible Double-read / TOCTOU due to a…
-
Unscored —
In ac_remove_smmu_prot_internal of acfw_smmu.c, there is a possible Logic error due to a logic error in the code. This …
-
Medium 6.7
In handle_fips_hmac_req of hwcrypto_proxy.c, there is a possible heap buffer overflow due to missing bounds check. This…
-
Unscored —
In multiple locations, there is a possible way to trigger an out of bounds read and write in shared memory due to an in…
-
Unscored —
In multiple functions of sswrp_cpm.dtsi, there is a possible way to modify voltage control registers from non-secure so…
-
Unscored —
In multiple locations, there is a possible information disclosure due to a logic error in the code. This could lead to …
-
Unscored —
In aes256_cmac_sw of aes.rs, there is a possible way to forge message authentication codes over multi-block messages du…
-
Unscored —
In multiple functions of attestation_object.c, there is a possible way to disclose uninitialized secure element stack m…
-
Unscored —
In multiple files, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote cod…
-
Medium 6.7
In ac_set_ns_ipa_tbl of plat_trusty.c, there is a possible way to corrupt stream table entry configurations via unvalid…
-
Unscored —
In secure_transport_usecase_handshake of secure_transport.c, there is a possible way to bypass secure transport channel…
-
Unscored —
In GetSharedMemory of trusty_shared_memory_manager.cc, there is a possible way to trigger an out of bounds read via sig…
-
Medium 6.7
In km_read_data_response of keymaster.c, there is a possible way to trigger an out of bounds write on the heap due to a…
-
Unscored —
In TzSharedMemory of TzSharedMemory.c, there is a possible Heap buffer overflow due to a logic error in the code. This …
-
Unscored —
In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote c…
-
Unscored —
In parse_prime256v1 of keymint_asn1.c, there is a possible Heap Buffer Overflow due to a logic error in the code. This …
-
Unscored —
In thread_free of thread.c, there is a possible way to corrupt kernel heap metadata on thread creation failure due to m…
-
Unscored —
In handle_dpm_image of seclib.rs, there is a possible Logic error due to a logic error in the code. This could lead to …
-
Unscored —
In insert_node of remap.c, there is a possible way to trigger an out of bounds write in the address remapping table due…
-
Unscored —
In N/A of gdmc/gsp/project/gdmc.mk, there is a possible Logic error due to a logic error in the code. This could lead t…
-
Unscored —
In multiple functions of verifier.rs, there is a possible way to bypass secure boot signature verification via fault in…
-
Medium 6.4
In handle_chan_msg of tipc_virtio_dev.c, there is a possible way to bypass memory tag access controls via concurrent sh…
-
Unscored —
In ext_mem_obj_get_page of memss-mfw.c, there is a possible way to return an out of bounds physical address via an off-…
-
Unscored —
In fill of dma.rs, there is a possible way to trigger an out of bounds stack read during direct memory access fills due…
-
Unscored —
In handle_rx_msg of tipc_virtio_dev, there is a possible Double Fetch TOCTOU due to Double Fetch. This could lead to lo…
-
Unscored —
In event_set_sub of acropora_event.c, there is a possible Logic error due to a logic error in the code. This could lead…
-
Unscored —
In multiple functions of arm-smmu-v3.c, there is a possible way to bypass direct memory access isolation via stale stre…
-
Unscored —
In multiple locations, there is a possible way to bypass key authorization policies during wrapped key import due to a …
-
Unscored —
In multiple functions of Android.bp, there is a possible way to bind to a privileged debug overlay service due to test …
-
Medium 6.7
In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check. This c…
-
High 7.8
An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when …