Google Rolls Out Fixes for High-Severity Android System Flaws

Google has released patches addressing high-severity flaws in its System component. The flaws could be remotely exploited to gain access to additional permissions. Overall, 50 flaws were patched as part of Google’s October security update for the Android operating system, released on Monday. As...

The vulnerability of the kernel function kgsl_mem_entryDestroy in Qualcomm software allows a attacker to cause the system to abruptly terminate the execution of kernel code.

The vulnerability of the kernel function kgslmementrydestroy drivers/gpu/msm/kgsl.c in Qualcomm software is caused by synchronization errors when using shared resources. Exploiting this vulnerability can allow a remote attacker to cause the kernel code to terminate emergently...

The vulnerability of Qualcomm’s AVT driver, related to pointer swapping errors, allows a hacker to gain unauthorized access to protected information.

The vulnerability of Qualcomm’s AVT driver is related to errors in pointer assignment. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

Vulnerabilities fixed in Android

Google has fixed several vulnerabilities in the Android operating system. The vulnerabilities allow a malicious person to able to perform attacks that can lead to the following types of damage: Remote code execution User rights. Access to sensitive data Increased user privileges Google has...

Google Squashes Critical Android Media Framework Bug

Google patched a critical vulnerability in the Media Framework of its Android operating system, which if exploited could lead to remote code execution attacks on vulnerable devices. Overall, Google fixed flaws tied to 53 CVEs as part of its September security updates for the Android operating...

CVE-2020-3611

u'XBL SEC clears only ZI region when loading Qualcomm-signed segments can lead to improper access issue' in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in APQ8098, Kamorta, MSM8998, QCS404, QCS605, SDA66...

CVE-2019-14117

u'Whenever the page list is updated via privileged user, the previous list elements are freed but are not deleted from the list which results in a use after free causing an unhandled page fault exception in rmnet driver' in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdrago...

Improper access control

u'XBL SEC clears only ZI region when loading Qualcomm-signed segments can lead to improper access issue' in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in APQ8098, Kamorta, MSM8998, QCS404, QCS605, SDA66...

CVE-2020-3620

CVE-2020-3620 affects a wide range of Qualcomm Snapdragon platforms (Auto/Compute/Connectivity etc.) through G-link SMEM transport. The root cause is a lack of bounds checking for an integer overflow during a round-up operation on data read from shared memory, which can lead to memory corruption ...

CVE-2020-3611

u'XBL SEC clears only ZI region when loading Qualcomm-signed segments can lead to improper access issue' in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in APQ8098, Kamorta, MSM8998, QCS404, QCS605, SDA66...

CVE-2020-3611

CVE-2020-3611 affects Qualcomm/Qualcomm-based Snapdragon platforms (e.g., APQ8098, Kamorta, MSM8998, QCS404/605, SDA660/845, SDM6xx/7xx, SXR1130, etc.). The root cause is an improper access issue caused by XBL SEC clearing only the ZI region when loading Qualcomm-signed segments, which can lead t...

Attacking the Qualcomm Adreno GPU

Posted by Ben Hawkes, Project Zero When writing an Android exploit, breaking out of the application sandbox is often a key step. There are a wide range of remote attacks that give you code execution with the privileges of an application like the browser or a messaging application, but a sandbox...

PT-2020-9078 · Qualcomm · Ipq6018 +34

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon versions affected versions not specified Description: The issue is related to improper authentication and signature verification of debug policies in the secure boot loader, which allows unverified debug policies to be...

USN-4485-1: Linux kernel vulnerabilities

Timothy Michaud discovered that the i915 graphics driver in the Linux kernel did not properly validate user memory locations for the i915gemexecbuffer2ioctl. A local attacker could possibly use this to cause a denial of service or execute arbitrary code. CVE-2018-20669 It was discovered that the...

USN-4463-1: Linux kernel vulnerabilities

It was discovered that the bcache subsystem in the Linux kernel did not properly release a lock in some error conditions. A local attacker could possibly use this to cause a denial of service. CVE-2020-12771 Kyungtae Kim discovered that the USB testing driver in the Linux kernel did not properly...

Over a Billion Android Devices Are at Risk of Data Theft

Qualcomm has released a fix for the flaws in its Snapdragon chip, which attackers might exploit to monitor location or render the phone unresponsive...

Qualcomm Bugs Open 40 Percent of Android Handsets to Attack

Six serious bugs in Qualcomm’s Snapdragon mobile chipset impact up to 40 percent of Android phones in use, according research released at the DEF CON Safe Mode security conference Friday. The flaws open up handsets made by Google, Samsung, LG, Xiaomi and OnePlus to DoS and escalation-of-privilege...

High-Severity Android RCE Flaw Fixed in August Security Update

Google has released patches addressing a high-severity issue in its Framework component, which if exploited could enable remote code execution RCE on Android mobile devices. Overall, 54 high-severity flaws were patched as part of Google’s August security updates for the Android operating system,...

CVE-2016-5342

Heap-based buffer overflow in the wcnsswlanwrite function in drivers/net/wireless/wcnss/wcnsswlan.c in the wcnsswlan device driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center QuIC Android contributions for MSM devices and other products, allows attackers to cause a denial of...

CVE-2016-2064

sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c in the MSM QDSP6 audio driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center QuIC Android contributions for MSM devices and other products, allows attackers to cause a denial of service buffer over-read or possibly have unspecified...