CVE-2022-20451

In onCallRedirectionComplete of CallsManager.java, there is a possible permissions bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions:...

CVE-2022-32617

CVE-2022-32617 affects the typec component in affected MediaTek hardware. The root cause is an out-of-bounds write caused by an incorrect buffer-size calculation, enabling local privilege escalation for an attacker with physical access and no extra privileges or user interaction required. The vul...

CVE-2022-32612

CVE-2022-32612 concerns a possible memory-use-after-free in the MediaTek/vcu stack caused by a race condition. Reported as enabling local escalation of privilege with System execution privileges required and no user interaction needed. Multiple sources confirm the issue, but public details about ...

CVE-2022-32615

CVE-2022-32615 concerns an out‑of‑bounds write in the ccd component caused by uninitialized data, enabling local privilege escalation with system execution privileges required. No user interaction is needed. The vulnerability details are supported by multiple sources in the provided documents, wi...

CVE-2022-32618

Summary of CVE-2022-32618 : A miscalculation of buffer size in the Type-C functionality can cause an out-of-bounds write. This vulnerability could enable local privilege escalation on devices with physical access and does not require user interaction. The issue is described across multiple source...

CVE-2022-20452

In initializeFromParcelLocked of BaseBundle.java, there is a possible method arbitrary code execution due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions...

CVE-2022-32608

In jpeg, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07388753; Issue ID: ALPS07388753...

CVE-2022-32607

CVE-2022-32607 affects the aee component in MediaTek-derived implementations. The root cause is a use-after-free caused by a missing bounds check, enabling local escalation to System privileges without user interaction. The vulnerability is described with a local attack vector and high impact on ...

CVE-2022-20450

In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way to bypass user consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Produc...

CVE-2022-20441

In navigateUpTo of Task.java, there is a possible way to launch an unexported intent handler due to a logic error in the code. This could lead to local escalation of privilege if the targeted app has an intent trampoline, with no additional execution privileges needed. User interaction is not...

CVE-2022-32618

In typec, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege, for an attacker who has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitatio...

CVE-2022-21778

The CVE-2022-21778 issue affects MediaTek’s vpu, where an incorrect bounds check can trigger information disclosure and potentially local privilege escalation. The vulnerability requires local access (attack vector: LOCAL), with no user interaction, and a high privileges requirement for exploitat...

CVE-2022-20454

CVE-2022-20454 affects Google Android. A vulnerability in the fdt_next_tag function of fdt.c can cause an out-of-bounds write due to an integer overflow, potentially enabling local elevation of privilege with SYSTEM rights and no user interaction. Affected Android versions include 10–13. The Andr...

CVE-2022-32614

CVE-2022-32614 concerns a memory corruption flaw in Audio processing within MediaTek chipsets. The root cause is a logic error in the audio path that can allow local privilege escalation to SYSTEM level with no user interaction required. Exploitation details are not provided in the available docu...

CVE-2022-20457

In getMountModeInternal of StorageManagerService.java, there is a possible prevention of package installation due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2022-20446

In AlwaysOnHotwordDetector of AlwaysOnHotwordDetector.java, there is a possible way to access the microphone from the background due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2021-1050

In MMUUnmapPages of the PowerVR kernel driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android...

PT-2022-14673 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-10 through Android-13 Description: The issue is related to a missing permission check in the onCallRedirectionComplete function of CallsManager.java. This could lead to a local escalation of privilege with no addition...

CVE-2022-21778

In vpu, there is a possible information disclosure due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06382421; Issue ID: ALPS06382421...

CVE-2022-20465

In dismiss and related functions of KeyguardHostViewController.java and related files, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...