CVE-2015-8997

CVE-2015-8997 is described in the Connected documents as a time-of-check time-of-use race condition in the listener routine of TrustZone on Android CAF builds using the Linux kernel. The vulnerability is tied to TrustZone’s listener code, with public sources noting a TOCTOU race condition potenti...

CVE-2015-8999

CVE-2015-8999: The vulnerability is described as a TrustZone buffer overflow that can occur in Android CAF builds when loading an ELF file. Connected sources corroborate a TrustZone buffer overflow in Android’s TrustZone component with potential for arbitrary code execution or denial of service, ...

CVE-2015-9002

This CVE concerns Google Android TrustZone, where a DRM routine in the TrustZone DRM path can suffer an out-of-range pointer offset (integer overflow) vulnerability. Connected CNVD entry explicitly states an integer overflow in the TrustZone DRM routine exists on Android, and that an attacker cou...

CVE-2015-8998

CVE-2015-8998 describes an integer overflow in TrustZone that could potentially affect Android devices using the CAF Linux kernel. Connected sources reiterate TrustZone/CAF exposure and label it as an integer overflow inTrustZone components; no further technical specifics (affected versions, expl...

CVE-2014-9931

CVE-2014-9931 is a buffer overflow in CAF Linux kernel used by Android; triggered when an OEM customizes app region size due to a hard-coded value. Exploitation is local with user interaction; impact is high on confidentiality, integrity, and availability. No remediation details provided in the s...

CVE-2014-9934

A PKCS1 v1.5 signature verification routine in all Android releases from CAF using the Linux kernel may not check padding...

CVE-2015-9001

Technical details, affected components, and remediation for CVE-2015-9001 are not publicly provided in the connected documents. Monitor updates from NVD/Android sources.

CVE-2014-9933

Due to missing input validation in all Android releases from CAF using the Linux kernel, HLOS can write to fuses for which it should not have access...

CVE-2015-9000

Technical details about CVE-2015-9000 are not publicly available in the provided Connected documents; the description only states a TrustZone untrusted pointer dereference in a DRM routine across CAF Android kernel releases.

CVE-2014-9933: Improper Input Validation

Due to missing input validation in all Android releases from CAF using the Linux kernel, HLOS can write to fuses for which it should not have access...

PT-2017-2119

Name of the Vulnerable Software and Affected Versions Android releases from CAF affected versions not specified Description The issue is related to the handling of shared content protection memory in Android releases from CAF. If this memory is passed as the secure camera memory buffer to a trust...

PT-2017-2130

Name of the Vulnerable Software and Affected Versions Android releases from CAF using the Linux kernel Description The issue is related to an integer overflow vulnerability in a DRM routine within TrustZone, potentially leading to a buffer overflow. This vulnerability could allow a remote attacke...

PT-2017-2129

Name of the Vulnerable Software and Affected Versions Android releases from CAF using the Linux kernel Description A time-of-check time-of-use race condition could potentially exist in an authentication routine in TrustZone. This issue is caused by synchronization errors when using a shared...

PT-2017-2133

Name of the Vulnerable Software and Affected Versions Android releases from CAF using the Linux kernel affected versions not specified Description The issue is related to an integer overflow vulnerability in TrustZone, potentially affecting all Android releases from CAF using the Linux kernel. Th...

Null pointer dereference

In function msmpcmplaybackclose in all Android releases from CAF using the Linux kernel, prtd is assigned substream-runtime-privatedata. Later, prtd is freed. However, prtd is not sanitized and set to NULL, resulting in a dangling pointer. There are other functions that access the same memory...

Out-of-bounds

In all Android releases from CAF using the Linux kernel, while processing a voice SVC request which is nonstandard by specifying a payload size that will overflow its own declared size, an out of bounds memory copy occurs...

Race condition

In coreinforead and instinforead in all Android releases from CAF using the Linux kernel, variable "dbgbuf", "dbgbuf-curr" and "dbgbuf-filledsize" could be modified by different threads at the same time, but they are not protected with mutex or locks. Buffer overflow is possible on race condition...

CVE-2017-8244

In coreinforead and instinforead in all Android releases from CAF using the Linux kernel, variable "dbgbuf", "dbgbuf-curr" and "dbgbuf-filledsize" could be modified by different threads at the same time, but they are not protected with mutex or locks. Buffer overflow is possible on race condition...

CVE-2017-8246

In function msmpcmplaybackclose in all Android releases from CAF using the Linux kernel, prtd is assigned substream-runtime-privatedata. Later, prtd is freed. However, prtd is not sanitized and set to NULL, resulting in a dangling pointer. There are other functions that access the same memory...

CVE-2017-8244

In coreinforead and instinforead in all Android releases from CAF using the Linux kernel, variable "dbgbuf", "dbgbuf-curr" and "dbgbuf-filledsize" could be modified by different threads at the same time, but they are not protected with mutex or locks. Buffer overflow is possible on race condition...