CVE-2021-0947

The method PVRSRVBridgeTLDiscoverStreams allocates puiStreamsInt on the heap, fills the contents of the buffer via TLServerDiscoverStreamsKM, and then copies the buffer to userspace. The method TLServerDiscoverStreamsKM may fail for several reasons including invalid sizes. If this method fails th...

CVE-2021-0946

The method PVRSRVBridgePMRPDumpSymbolicAddr allocates puiMemspaceNameInt on the heap, fills the contents of the buffer via PMRPDumpSymbolicAddr, and then copies the buffer to userspace. The method PMRPDumpSymbolicAddr may fail, and if it does the buffer will be left uninitialized and despite the...

CVE-2021-0947

CVE-2021-0947 involves a kernel information disclosure in Android's graphics stack. The method PVRSRVBridgeTLDiscoverStreams allocates a heap buffer for streams, fills it via TLServerDiscoverStreamsKM, then copies it to userspace. If TLServerDiscoverStreamsKM fails (e.g., due to invalid sizes), t...

CVE-2021-0946

The method PVRSRVBridgePMRPDumpSymbolicAddr allocates puiMemspaceNameInt on the heap, fills the contents of the buffer via PMRPDumpSymbolicAddr, and then copies the buffer to userspace. The method PMRPDumpSymbolicAddr may fail, and if it does the buffer will be left uninitialized and despite the...

CVE-2021-0946

CVE-2021-0946 concerns a kernel information disclosure in Android via the PowerVR PVRSRVBridgePMRPDumpSymbolicAddr path. The vulnerable sequence allocates a heap buffer (puiMemspaceNameInt), fills it through PMR_PDumpSymbolicAddr, and copies the buffer to userspace. If PMR_PDumpSymbolicAddr fails...

PT-2022-9135 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to the fixed version Description: The issue arises from the method PVRSRVBridgeTLDiscoverStreams, which allocates a buffer on the heap and fills it via TLServerDiscoverStreamsKM. If TLServerDiscoverStreamsKM fails due t...

DEBIAN-CVE-2021-3736

A flaw was found in the Linux kernel. A memory leak problem was found in mbochsioctl in samples/vfio-mdev/mbochs.c in Virtual Function I/O VFIO Mediated devices. This flaw could allow a local attacker to leak internal kernel information...

ASB-A-236846966

The method PVRSRVBridgePMRPDumpSymbolicAddr allocates puiMemspaceNameInt on the heap, fills the contents of the buffer via PMRPDumpSymbolicAddr, and then copies the buffer to userspace. The method PMRPDumpSymbolicAddr may fail, and if it does the buffer will be left uninitialized and despite the...

kernel: out-of-bounds read in bpf_skb_change_head() of filter.c due to a use-after-free

An out-of-bounds OOB memory access flaw was found in net/core/filter.c in bpfskbmaxlen in the Linux kernel. A missing sanity check to the current MTU check may allow a local attacker with special user privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal...

Information disclosure

In doiptgetctl and doiptsetctl of iptables.c, there is a possible way to leak kernel information due to uninitialized data. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android...

Huawei HarmonyOS 资源管理错误漏洞

Huawei HarmonyOS is an operating system from Huawei, a Chinese company that provides a microkernel-based distributed operating system. Huawei HarmonyOS 2.0 previously had a security vulnerability that could be exploited by a local attacker to cause a kernel information leak...

CVE-2020-35499

A NULL pointer dereference flaw in Linux kernel versions prior to 5.11 may be seen if scosockgetsockopt function in net/bluetooth/sco.c do not have a sanity check for a socket connection, when using BTSNDMTU/BTRCVMTU for SCO sockets. This could allow a local attacker with a special user privilege...

CVE-2020-10840

An issue was discovered on Samsung mobile devices with P9.0 and Q10.0 Exynos 9610 chipsets software. There is a kernel pointer leak in the vipx driver. The Samsung ID is SVE-2019-16293 February 2020...

kernel: sensitive information disclosure from kernel stack memory via HIDPCONNADD command

A flaw was found in the Linux kernel's implementation of the Bluetooth Human Interface Device Protocol HIDP. A local attacker with access permissions to the Bluetooth device can issue an IOCTL which will trigger the dohidpsockioctl function in net/bluetooth/hidp/sock.c.c. This function can leak...

CVE-2019-18567

Bromium client version 4.0.3.2060 and prior to 4.1.7 Update 1 has an out of bound read results in race condition causing Kernel memory leaks or denial of service...

kernel: Heap address information leak while using L2CAP_GET_CONF_OPT

A flaw was found in the Linux kernel's implementation of Logical Link Control and Adaptation Protocol L2CAP, part of the Bluetooth stack. An attacker, within the range of standard Bluetooth transmissions, can create and send a specially crafted packet. The response to this specially crafted packe...

CVE-2019-5522

VMware Tools for Windows update addresses an out of bounds read vulnerability in vm3dmp driver which is installed with vmtools in Windows guest machines. This issue is present in versions 10.2.x and 10.3.x prior to 10.3.10. A local attacker with non-administrative access to a Windows guest with...

kernel: Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c

Memory leak in the sassmpgetphyevents function in drivers/scsi/libsas/sasexpander.c in the Linux kernel allows local users to cause a denial of service kernel memory exhaustion via multiple read accesses to files in the /sys/class/sasphy directory...

kernel: Stack information leak in the EFS element

A flaw was found in the processing of incoming L2CAP bluetooth commands. Uninitialized stack variables can be sent to an attacker leaking data in kernel address space...

kernel: Information leak in Linux sound module in timer.c

A vulnerability was found in Linux kernel. There is an information leak in file "sound/core/timer.c" of the latest mainline Linux kernel, the stack object “tread” has a total size of 32 bytes. It contains a 8-bytes padding, which is not initialized but sent to user via copytouser, resulting a...