Null pointer dereference

In all Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall...

Buffer overflow

In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in a TrustZone syscall...

Design/Logic Flaw

In all Qualcomm products with Android releases from CAF using the Linux kernel, a variable is uninitialized in a TrustZone system call potentially leading to the compromise of secure memory...

CVE-2015-9073

CVE-2015-9073 : Concrete details available across sources show a vulnerability in Qualcomm components within Android CAF builds using the Linux kernel, where an untrusted pointer could be dereferenced in a TrustZone syscall. The issue affects Qualcomm’s closed-source/TrustZone pathway inside Andr...

CVE-2015-9070

CVE-2015-9070 describes a buffer over-read vulnerability in the TrustZone syscall of Qualcomm closed-source components used in Android builds (CAF Linux kernel). The issue affects Qualcomm components within Android devices that rely on CAF Linux kernels and TrustZone. The root cause is a buffer o...

CVE-2015-9070

In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in a TrustZone syscall...

CVE-2014-9979

In all Qualcomm products with Android releases from CAF using the Linux kernel, a variable is uninitialized in a TrustZone system call potentially leading to the compromise of secure memory...

CVE-2014-9979

CVE-2014-9979 affects Qualcomm products with CAF Android builds using the Linux kernel. The vulnerability is a TrustZone system call issue caused by an uninitialized variable in the kernel, potentially leading to compromise of secure memory. The available documents explicitly describe the root ca...

CVE-2015-9072

CVE-2015-9072 is described as an untrusted pointer dereference in a Qualcomm TrustZone syscall affecting Qualcomm components in Android CAF builds using the Linux kernel. The vulnerability is rated with high/critical impact in CVSS terms (network access, no auth, user interaction not required; co...

CVE-2015-9073

In all Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall...

CVE-2015-9071

CVE-2015-9071 describes a buffer over-read in a TrustZone syscall present in all Qualcomm products with Android CAF builds using the Linux kernel. The vulnerability affects Qualcomm components integrated in Android and is triggered via a TrustZone interface, enabling a high-impact condition consi...

CVE-2015-9071

In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in a TrustZone syscall...

CVE-2015-9072

In all Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall...

Trust Issues: Exploiting TrustZone TEEs

Posted by Gal Beniamini, Project Zero Mobile devices are becoming an increasingly privacy-sensitive platform. Nowadays, devices process a wide range of personal and private information of a sensitive nature, such as biometric identifiers, payment data and cryptographic keys. Additionally, modern...

Google Android Qualcomm component integer overflow vulnerability (CNVD-2017-18950)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. An integer overflow vulnerability exists in TrustZone of Google Android. An attacker can exploit the vulnerability to execute arbitrary code...

Google Android Qualcomm component buffer overflow vulnerability (CNVD-2017-18947)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. A buffer overflow vulnerability exists in the DRM routine of TrustZone for Google Android. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial...

Google Android Qualcomm Component Competitive Condition Vulnerability (CNVD-2017-18946)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. A competitive condition vulnerability exists in the QFPROM routine of TrustZone for Google Android. An attack could exploit the vulnerability to perform unauthorized operations...

Google Android Qualcomm component buffer overflow vulnerability (CNVD-2017-18943)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. A buffer overflow vulnerability exists in Google Android's TrustZone. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service...

Google Android Qualcomm Component Information Disclosure Vulnerability (CNVD-2017-18942)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. An information disclosure vulnerability exists in Google Android's TrustZone. An attacker can exploit this vulnerability to obtain sensitive information...

Google Android Qualcomm Component Competitive Condition Vulnerability (CNVD-2017-18948)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. A competitive condition vulnerability exists in the authentication routine of TrustZone in versions of Android prior to 7.0. An attack could exploit the vulnerability to perform...