CVE-2022-20265

In Settings, there is a possible way to bypass factory reset permissions due to a permissions bypass. This could lead to local escalation of privilege with physical access to the device with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2022-20247

In Media, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-229858836...

CVE-2022-20406

CVE-2022-20406 is present in Pixel/Android kernel entries with Type ID (Information disclosure) affecting the Modem component. The connected Pixel bulletin confirms the CVE exists but provides no public exploit details or remediation in the provided documents. No additional technical specifics (v...

CVE-2022-20405

CVE-2022-20405 affects the Android kernel/modem stack used by Google Pixel devices, described as a Modem Elevation of Privilege vulnerability. Public details indicate a zero-click style chain that could downgrade the device’s cellular modem to 2G and potentially allow takeover of the handset via ...

CVE-2022-20405

Product: AndroidVersions: Android kernelAndroid ID: A-216363416References: N/A...

CVE-2022-20404

CVE-2022-20404 is listed in Pixel bulletin data as affecting Android devices via the Modem component (Type: Information disclosure; Severity: Moderate). The vulnerable entry maps to CVE-2022-20404 with Android kernel context in the initial doc, but Pixel security bulletin categorizes it under the...

CVE-2022-20403

Product: AndroidVersions: Android kernelAndroid ID: A-207975764References: N/A...

CVE-2022-20381

Summary (concrete details available): CVE-2022-20381 is mapped to the Android kernel in Google Pixel devices and is classified as an Elevation of Privilege (EoP) issue within the kernel component. The vulnerability is tracked in the NVD entry with a high-impact profile (CVSSv3.1: CVSS:3.1/AV:N/AC...

CVE-2022-20380

According to the Pixel security bulletin, CVE-2022-20380 is listed under the Pixel component Modem with type ID (information disclosure) and High severity. The entry is tied to Android devices via a modem-related information-disclosure issue, not clearly specifying kernel-level impact in this bul...

CVE-2022-20368

CVE-2022-20368 is confirmed in connected advisories as a slab-out-of-bounds access in packet_recvmsg() within the Linux kernel networking stack. The linked documents (e.g., ALSA-2022 kernel advisories for Linux kernels used in Debian/OpenSUSE/OpenSUSE/Linux distributions) explicitly reference thi...

#StopRansomware: MedusaLocker

Summary Actions to take today to mitigate cyber threats from ransomware: • Prioritize remediating known exploited vulnerabilities. • Train users to recognize and report phishing attempts. • Enable and enforce multifactor authentication. Note: this joint Cybersecurity Advisory CSA is part of an...

PT-2022-14508 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: In Bluetooth, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interactio...

PT-2022-14544 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: In DreamServices, there is a possible way to launch arbitrary protected activities due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User...

CVE-2022-20355

In get of PacProxyService.java, there is a possible system service crash due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12...

CVE-2022-20347

In onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due to a confused deputy. This could lead to remote escalation of privilege in Bluetooth settings with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2021-39696

In Task.java, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID:...

Information disclosure

In writeToParcel of SurfaceControl.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12...

Race condition

In stealReceiveChannel of EventThread.cpp, there is a possible way to interfere with process communication due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

Information disclosure

In startSync of AbstractThreadedSyncAdapter.java, there is a possible way to access protected content of content providers due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for...

Privilege escalation

In setChecked of SecureNfcPreferenceController.java, there is a missing permission check. This could lead to local escalation of privilege from the guest user with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10...