CVE-2015-9072

In all Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall...

CVE-2015-9070

In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in a TrustZone syscall...

Null pointer dereference

In all Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall...

Design/Logic Flaw

In all Qualcomm products with Android releases from CAF using the Linux kernel, a variable is uninitialized in a TrustZone system call potentially leading to the compromise of secure memory...

Buffer overflow

In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in a TrustZone syscall...

Null pointer dereference

In all Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall...

Buffer overflow

In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in a TrustZone syscall...

CVE-2014-9979

In all Qualcomm products with Android releases from CAF using the Linux kernel, a variable is uninitialized in a TrustZone system call potentially leading to the compromise of secure memory...

CVE-2015-9071

CVE-2015-9071 describes a buffer over-read in a TrustZone syscall present in all Qualcomm products with Android CAF builds using the Linux kernel. The vulnerability affects Qualcomm components integrated in Android and is triggered via a TrustZone interface, enabling a high-impact condition consi...

CVE-2015-9070

CVE-2015-9070 describes a buffer over-read vulnerability in the TrustZone syscall of Qualcomm closed-source components used in Android builds (CAF Linux kernel). The issue affects Qualcomm components within Android devices that rely on CAF Linux kernels and TrustZone. The root cause is a buffer o...

CVE-2014-9979

CVE-2014-9979 affects Qualcomm products with CAF Android builds using the Linux kernel. The vulnerability is a TrustZone system call issue caused by an uninitialized variable in the kernel, potentially leading to compromise of secure memory. The available documents explicitly describe the root ca...

CVE-2015-9070

In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in a TrustZone syscall...

CVE-2015-9073

CVE-2015-9073 : Concrete details available across sources show a vulnerability in Qualcomm components within Android CAF builds using the Linux kernel, where an untrusted pointer could be dereferenced in a TrustZone syscall. The issue affects Qualcomm’s closed-source/TrustZone pathway inside Andr...

CVE-2015-9072

CVE-2015-9072 is described as an untrusted pointer dereference in a Qualcomm TrustZone syscall affecting Qualcomm components in Android CAF builds using the Linux kernel. The vulnerability is rated with high/critical impact in CVSS terms (network access, no auth, user interaction not required; co...

CVE-2015-9071

In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in a TrustZone syscall...

CVE-2014-9979

In all Qualcomm products with Android releases from CAF using the Linux kernel, a variable is uninitialized in a TrustZone system call potentially leading to the compromise of secure memory...

CVE-2015-9072

In all Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall...

CVE-2015-9073

In all Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall...

Trust Issues: Exploiting TrustZone TEEs

Posted by Gal Beniamini, Project Zero Mobile devices are becoming an increasingly privacy-sensitive platform. Nowadays, devices process a wide range of personal and private information of a sensitive nature, such as biometric identifiers, payment data and cryptographic keys. Additionally, modern...

Google Android Qualcomm Component Competitive Condition Vulnerability (CNVD-2017-18948)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. A competitive condition vulnerability exists in the authentication routine of TrustZone in versions of Android prior to 7.0. An attack could exploit the vulnerability to perform...