1517 matches found
CVE-2016-10239
CVE-2016-10239 involves a potential bypass of the TrustZone access control policy in Android CAF builds using the Linux kernel. The description notes improper input validation that could cause an integer overflow, potentially leading to a buffer overflow and a buffer over-read. The NVD entry also...
CVE-2015-8997
CVE-2015-8997 is described in the Connected documents as a time-of-check time-of-use race condition in the listener routine of TrustZone on Android CAF builds using the Linux kernel. The vulnerability is tied to TrustZone’s listener code, with public sources noting a TOCTOU race condition potenti...
Null pointer dereference
In function msmpcmplaybackclose in all Android releases from CAF using the Linux kernel, prtd is assigned substream-runtime-privatedata. Later, prtd is freed. However, prtd is not sanitized and set to NULL, resulting in a dangling pointer. There are other functions that access the same memory...
CVE-2017-8244
In coreinforead and instinforead in all Android releases from CAF using the Linux kernel, variable "dbgbuf", "dbgbuf-curr" and "dbgbuf-filledsize" could be modified by different threads at the same time, but they are not protected with mutex or locks. Buffer overflow is possible on race condition...
Race condition
In coreinforead and instinforead in all Android releases from CAF using the Linux kernel, variable "dbgbuf", "dbgbuf-curr" and "dbgbuf-filledsize" could be modified by different threads at the same time, but they are not protected with mutex or locks. Buffer overflow is possible on race condition...
Out-of-bounds
In all Android releases from CAF using the Linux kernel, while processing a voice SVC request which is nonstandard by specifying a payload size that will overflow its own declared size, an out of bounds memory copy occurs...
CVE-2017-8246
In function msmpcmplaybackclose in all Android releases from CAF using the Linux kernel, prtd is assigned substream-runtime-privatedata. Later, prtd is freed. However, prtd is not sanitized and set to NULL, resulting in a dangling pointer. There are other functions that access the same memory...
CVE-2017-8245
In all Android releases from CAF using the Linux kernel, while processing a voice SVC request which is nonstandard by specifying a payload size that will overflow its own declared size, an out of bounds memory copy occurs...
CVE-2017-8244
In coreinforead and instinforead in all Android releases from CAF using the Linux kernel, variable "dbgbuf", "dbgbuf-curr" and "dbgbuf-filledsize" could be modified by different threads at the same time, but they are not protected with mutex or locks. Buffer overflow is possible on race condition...
CVE-2017-8246
CVE-2017-8246 concerns the Android CAF ALSA PCM Playback Kernel Module. In msm_pcm_playback_close(), prtd is assigned from substream->runtime->private_data and later freed, but not sanitized to NULL; this creates a dangling pointer. Other code paths (e.g., msm_pcm_volume_ctl_put()) check fo...
CVE-2017-8246
In function msmpcmplaybackclose in all Android releases from CAF using the Linux kernel, prtd is assigned substream-runtime-privatedata. Later, prtd is freed. However, prtd is not sanitized and set to NULL, resulting in a dangling pointer. There are other functions that access the same memory...
CVE-2017-8244
CVE-2017-8244 affects Android CAF builds leveraging the Linux kernel. The vulnerability arises in core_info_read and inst_info_read where the buffer structures dbg_buf, dbg_buf->curr, and dbg_buf->filled_size can be concurrently modified by multiple threads without mutexes/locks. This race ...
CVE-2017-8246
In function msmpcmplaybackclose in all Android releases from CAF using the Linux kernel, prtd is assigned substream-runtime-privatedata. Later, prtd is freed. However, prtd is not sanitized and set to NULL, resulting in a dangling pointer. There are other functions that access the same memory...
CVE-2017-8245
CVE-2017-8245 affects Android releases from CAF using the Linux kernel. The issue occurs while processing a voice SVC request with a payload size that overflows its declared size, causing an out-of-bounds memory copy. The initial documents provide no vendor/version specifics beyond CAF Android an...
CVE-2014-9927
In UIM in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist...
CVE-2014-9924
In 1x in all Android releases from CAF using the Linux kernel, a Signed to Unsigned Conversion Error could potentially occur...
CVE-2016-10297
In TrustZone in all Android releases from CAF using the Linux kernel, a Time-of-Check Time-of-Use Race Condition vulnerability could potentially exist...
CVE-2014-9926
In GNSS in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist...