CVE-2015-9022

Technical details about CVE-2015-9022 are not provided in the supplied documents. The description notes TOCTOU race conditions in TZ APIs on CAF Android/Linux kernel; no patch version or affected components specified here. Monitor for updates.

CVE-2015-9022: Concurrent Execution using Shared Resource with Improper Synchronization

In all Android releases from CAF using the Linux kernel, time-of-check Time-of-use TOCTOU Race Conditions exist in several TZ APIs...

CVE-2014-9966: Concurrent Execution using Shared Resource with Improper Synchronization

In all Android releases from CAF using the Linux kernel, a Time-of-check Time-of-use TOCTOU Race Condition vulnerability exists in Secure Display...

PT-2017-2295

Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description The issue is caused by synchronization errors when using a shared resource in the TimeZone component of the Android operating system. This can allow a remote attacker to modify the shared...

PT-2017-2290

Name of the Vulnerable Software and Affected Versions Android versions affected versions not specified Description The issue is caused by synchronization errors when using a shared resource in the Secure Display component of the Android operating system. This can allow a remote attacker to modify...

Chmod Race Condition

github.com/lxc/lxd contains a chmod Time-of-Check-Time-of-Use TOCTOU race condition. The vulnerability exists as the file descriptor to the entry that was processed was not validated...

CVE-2017-0331: Time-of-check Time-of-use (TOCTOU) Race Condition

An elevation of privilege vulnerability in the NVIDIA video driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the...

PT-2017-3266

Name of the Vulnerable Software and Affected Versions File-Path module versions prior to 2.13 Description The issue is related to a race condition in the rmtree and remove tree functions of the File-Path module for Perl. This condition arises due to errors in synchronization when using shared...

CVE-2017-0412: Time-of-check Time-of-use (TOCTOU) Race Condition

An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally...

CVE-2017-0411: Time-of-check Time-of-use (TOCTOU) Race Condition

An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally...

CVE-2016-8438

Integer overflow leading to a TOCTOU condition in hypervisor PIL. An integer overflow exposes a race condition that may be used to bypass Peripheral Image Loader PIL authentication. Product: Android. Versions: Kernel 3.18. Android ID: A-31624565. References: QC-CR1023638...

Integer overflow

Integer overflow leading to a TOCTOU condition in hypervisor PIL. An integer overflow exposes a race condition that may be used to bypass Peripheral Image Loader PIL authentication. Product: Android. Versions: Kernel 3.18. Android ID: A-31624565. References: QC-CR1023638...

CVE-2016-8438

Integer overflow leading to a TOCTOU condition in hypervisor PIL. An integer overflow exposes a race condition that may be used to bypass Peripheral Image Loader PIL authentication. Product: Android. Versions: Kernel 3.18. Android ID: A-31624565. References: QC-CR1023638...

CVE-2016-8438

CVE-2016-8438 describes an integer overflow in the Android kernel’s Peripheral Image Loader (PIL) path that leads to a TOCTOU condition, potentially bypassing PIL authentication. Affected product: Android (kernel 3.18). Root cause is an integer overflow exposing a race condition; impact is descri...

Firejail Privilege Escalation

firejail advisory for TOCTOU in --get and --put local root Releasing a brief advisory/writeup about a local root privesc found in firejail that we reported back in Nov, 2016. This is in response to a recent thread on oss-sec where people seem interested in details of firejail security issues. Thi...

Firejail - Privilege Escalation Exploit

Exploit for linux platform in category local exploits firejail advisory for TOCTOU in --get and --put local root Releasing a brief advisory/writeup about a local root privesc found in firejail that we reported back in Nov, 2016. This is in response to a recent thread on oss-sec where people seem...

CVE-2016-8438: Integer Overflow or Wraparound

Integer overflow leading to a TOCTOU condition in hypervisor PIL. An integer overflow exposes a race condition that may be used to bypass Peripheral Image Loader PIL authentication. Product: Android. Versions: Kernel 3.18. Android ID: A-31624565. References: QC-CR1023638...

PT-2017-1104

Name of the Vulnerable Software and Affected Versions Android versions prior to the fixed version Description The issue is caused by an integer overflow leading to a Time-of-Check-to-Time-of-Use TOCTOU condition in the hypervisor Peripheral Image Loader PIL. This exposes a race condition that may...

Firejail - Local Privilege Escalation

Firejail - Local Privilege Escalation firejail advisory for TOCTOU in --get and --put local root Releasing a brief advisory/writeup about a local root privesc found in firejail that we reported back in Nov, 2016. This is in response to a recent thread on oss-sec where people seem interested in...

Firejail - Local Privilege Escalation

firejail advisory for TOCTOU in --get and --put local root Releasing a brief advisory/writeup about a local root privesc found in firejail that we reported back in Nov, 2016. This is in response to a recent thread on oss-sec where people seem interested in details of firejail security issues. Thi...