CVE-2020-25050

CVE-2020-25050 affects Samsung mobile devices running P(9.0) and Q(10.0). The issue is in the CMC service, which can allow attackers to obtain sensitive information. Affected component is the CMC service on Samsung Android builds; root cause details are not fully disclosed in the provided documen...

CVE-2020-25059

CVE-2020-25059 affects LG mobile devices running Android OS 7.2, 8.0, 8.1, 9, and 10. The issue is a service crash caused by incorrect input validation (LG ID LVE-SMP-200013). No further technical details (exploit paths, specific components, or remediation) are provided in the connected documents...

CVE-2020-27044

CVE-2020-27044 affects Android 11 in Parcel.cpp, restartWrite path, where a use-after-free leads to memory corruption. The issue is described as a local elevation of privilege without extra execution privileges required; user interaction is not needed. The vulnerability is reported with a high ba...

CVE-2021-0363

CVE-2021-0363 affects Android (Android-10 and Android-11) with vulnerability in the mobile_log_d component, caused by a missing bounds check that enables command injection and local escalation of privilege to SYSTEM without user interaction. The issue is documented in multiple sources (e.g., Andr...

CVE-2021-0372

CVE-2021-0372 is a local elevation of privilege in Android 11 via getMediaOutputSliceAction in RemoteMediaSlice.java, caused by an unsafe PendingIntent that bypasses permissions without requiring user interaction. The impact is escalation to higher privileges (HIGH per CVSSv3.1) with local access...

CVE-2021-0416

CVE-2021-0416 concerns the Mediatek memory management driver. The available descriptions state a vulnerability due to improper input validation that can cause a system crash, yielding local denial of service without requiring user interaction. Affected components are described as the memory manag...

CVE-2021-0456

CVE-2021-0456 : In the Citadel chip firmware, there is a possible out-of-bounds write due to a missing bounds check, enabling local escalation of privilege with System execution privileges required. Affected: Citadel chipset firmware in Android kernels (Android ID A-174769927). Impact per sources...

CVE-2021-0464

CVE-2021-0464 affects the Android kernel component sound_trigger_event_alloc in platform.h, with a heap buffer overflow causing an out-of-bounds write that could lead to local privilege escalation without user interaction. The linked Red Hat/NVD entries confirm the issue and classify it as Elevat...

CVE-2021-0494

CVE-2021-0494 affects the Android memory management driver on Android SoCs. The issue is an out-of-bounds write caused by an integer overflow, enabling local escalation of privilege with no user interaction required. The only details provided in the connected sources are that the vulnerability is...

CVE-2021-0531

CVE-2021-0531 affects the memory management driver in Android, specifically MTK memory management components, with a use-after-free leading to local privilege escalation and high impact as described in multiple sources. The vulnerability is a memory corruption issue in the memory management drive...

CVE-2021-0611

CVE-2021-0611 affects the Mediatek m4u component, where a memory corruption due to a use-after-free condition can cause local escalation of privilege to SYSTEM, with no user interaction required. The entry notes a patch ID ALPS05403499 and an issue ID ALPS05425810 as fixes. Connected documents re...

CVE-2021-0614

The CVE-2021-0614 entry concerns MediaTek’s asf extractor, where an out-of-bounds read results from an incorrect bounds check. This vulnerability may lead to local information disclosure without requiring user interaction or additional execution privileges. Affected reality is supported by source...

CVE-2021-0615

The CVE-2021-0615 entry concerns Mediatek’s flv extractor. The vulnerability is an out-of-bounds read caused by an integer overflow in the flv extractor’s processing, enabling local information disclosure without extra execution privileges. Impact is described as partial confidentiality loss with...

CVE-2021-0616

CVE-2021-0616 affects the MediaTek ape extractor. The issue is a heap buffer overflow causing an out-of-bounds read, leading to local information disclosure without extra privileges or user interaction. Affected component is the ape extractor (buffer handling) and the documents consistently descr...

CVE-2021-0626

CVE-2021-0626 describes a possible out-of-bounds write in ged due to a missing bounds check, potentially enabling local escalation of privilege to System level without user interaction. Multiple connected sources (NVD, Red Hat, CVE lists) confirm the same issue and reference Patch ID ALPS05687510...

CVE-2021-0899

In CVE-2021-0899, the apusys component in MediaTek exhibits a memory corruption issue caused by a use-after-free, enabling local escalation of privilege with System execution privileges required. No user interaction is needed for exploitation. Affected details and mitigation: Patch ID ALPS0567210...

CVE-2021-25430

CVE-2021-25430 is an improper access control vulnerability in a Bluetooth application, allowing untrusted apps to access Bluetooth information. Root cause: access-control failure in the Bluetooth component. Impact: confidentiality exposure at a LOW level (C:L) per CVSS3.1 (AV:A, AC:L, PR:N, UI:N,...

CVE-2021-25515

Samsung SemRewardManager on Android is affected by CVE-2021-25515 due to improper usage of implicit intents, enabling an attacker with local access to read the device’s BSSID. The root cause is an implicit-intent misuse in SemRewardManager prior to SMR Dec-2021 Release 1, leading to information d...

CVE-2021-25518

CVE-2021-25518 affects Samsung LDFW and BL31. The issue is an improper boundary check in the secure_log before SMR Dec-2021 Release 1, enabling arbitrary memory write and code execution. Reported impact includes local access with partial confidentiality/integrity/availability implications as per ...

CVE-2021-30161

CVE-2021-30161 affects LG mobile devices running Android 11. The vulnerability allows attackers to bypass the lockscreen protection after an incoming call has been terminated. Root cause, affected models/versions, exploit details, and fixes are not provided in the connected documents; remediation...

CVE-2022-20020

CVE-2022-20020 affects the libvcodecdrv component (noted in multiple sources, including Red Hat and CVE listings) where a missing bounds check can cause local information disclosure without requiring privileges or user interaction. Impact is confirmed as information disclosure; no exploitation ve...

CVE-2022-32645

CVE-2022-32645 affects vow and describes a race condition that could lead to local information disclosure with SYSTEM privileges required. Exploitation does not require user interaction. The CVE entry cites a patch ID ALPS07494477 (issue ALPS07494477) as the remediation. Multiple connected source...

CVE-2022-32646

CVE-2022-32646 describes a stack overflow in GPU DRM due to a missing bounds check, enabling local privilege escalation with SYSTEM execution privileges required and no user interaction. Multiple sources (NVD, Red Hat, CVE list, PRION, CNNVD-style entries) consistently reference the same issue an...

CVE-2022-39092

CVE-2022-39092 concerns a missing permission check in the power management service. The vulnerability allows a local attacker with LOW privileges and NO user interaction to set up the power management service without additional execution privileges, yielding HIGH impact to confidentiality, integr...

CVE-2022-39104

Summary (validated): CVE-2022-39104 affects the Contacts service, where a missing permission check could allow local denial of service without requiring additional execution privileges. The CVSS 3.1 base metrics indicate a Medium severity with Local attack vector and Availability impact. No expli...

CVE-2022-42781

CVE-2022-42781 concerns a missing bounds check in the WLAN driver, leading to local denial of service in WLAN services. The connected records identify the affected component as the WLAN driver (often referenced in UNISOC/UNISOC chipset contexts) and describe the vulnerability as an out-of-bounds ...

CVE-2022-47334

CVE-2022-47334 concerns the phasecheck server, where a missing bounds check can cause an out-of-bounds read. This vulnerability is described as enabling a local denial of service with system execution privileges required. The connected documents consistently relay the same underlying issue, thoug...

CVE-2022-47479

CVE-2022-47479 affects the telephony service. The root cause is a missing permission check, enabling local information disclosure without requiring additional privileges. CVSSv3.1 metrics indicate Local attack vector, Low attack complexity, Low privileges required, and Confidentiality impact High...

CVE-2022-47494

CVE-2022-47494 affects UNISOC chipsets’ soter service module. The root cause is a missing bounds check causing an out-of-bounds write, with impact described as local denial of service and potential for system-level execution privileges. Connected sources consistently reference this description ac...

CVE-2022-48237

CVE-2022-48237 affects UNISOC chipsets’ Image filter module. The vulnerability is an out-of-bounds write due to a missing bounds check, with impact as local denial of service and SYSTEM privileges required. Public exploitation details are not provided in the connected documents. Remediation/fix s...

CVE-2022-48248

The CVE-2022-48248 issue concerns UNISOC chipsets’ audio service, where a missing permission check could allow local privilege escalation with no extra privileges. Affected component is the audio service in the chipset’s software stack; root cause stated as insufficient authorization checks. The ...

CVE-2022-48375

CVE-2022-48375 concerns the UNISOC chipsets’ contacts service module, where a missing permission check may allow a local attacker to cause a denial of service with no additional privileges. The available documents consistently describe the issue as a local impact vulnerability due to insufficient...

CVE-2022-48383

CVE-2022-48383 affects the srtd service in UNISOC chipsets. The issue is a missing permission check that can lead to local privilege escalation with no extra privileges required. CVSSv3.1 score 7.8 (HIGH). Exploitation details are not provided in the documents; no remediation/version patch is cit...

CVE-2023-20647

This CVE (CVE-2023-20647) affects the ril module in MediaTek chips. The root cause is a missing bounds check that enables an out-of-bounds read, leading to local information disclosure with system execution privileges required. Exploitation is described as not requiring user interaction. Patch ID...

CVE-2023-20666

CVE-2023-20666 concerns a MediaTek display DRM component with an out-of-bounds write caused by a missing bounds check. The vulnerability enables local privilege escalation to System level without user interaction. The issue is indicated to affect the Display DRM path, with a patch identifier ALPS...

CVE-2023-20685

CVE-2023-20685 concerns the vdec component, where a race condition can trigger a use-after-free, resulting in local escalation of privilege to SYSTEM. The issue is exploitable without user interaction, via a local attack, as described in the CVE description, with a patch identified as ALPS0760857...

CVE-2023-20688

CVE-2023-20688 describes an out-of-bounds read due to a missing bounds check in Power, potentially enabling local information disclosure with SYSTEM privileges; exploitation is LOCAL with no user interaction required, and a patch is identified as ALPS07441821 (Issue ALPS07441821). Several connect...

CVE-2023-20689

CVE-2023-20689 affects MediaTek WLAN firmware; root cause is an integer overflow in the WLAN firmware that can trigger a system crash and remote denial of service. Exploitation does not require privileges or user interaction. Affected component: WLAN firmware (MediaTek). Mitigation: patch ALPS076...

CVE-2023-20717

CVE-2023-20717 relates to the vcu module where a race condition can leak a DMA buffer, enabling local information disclosure with SYSTEM privileges and no user interaction. A patch (ALPS07645185) exists; no exploitation details are provided in the connected documents. References show consistent d...

CVE-2023-20768

CVE-2023-20768 affects ion, with an out-of-bounds read caused by type confusion that can lead to local privilege escalation (System execution privileges required). Exploitation details are not provided in the available documents. A patch is identified (Patch ID ALPS07560720; Issue ALPS07559800).

CVE-2023-20813

CVE-2023-20813 affects MediaTek WLAN software/component where an out-of-bounds read occurs due to improper input validation. Impact described as local information disclosure with the need for System execution privileges; no user interaction required. Patch referenced: ALPS07453549 (Issue ID: ALPS...

CVE-2023-21317

CVE-2023-21317 : In Android’s ContentService, a side-channel disclosure can reveal whether an app is installed on the device without any query permissions, enabling local information disclosure with no user interaction. Affected component: ContentService/Android framework; root cause: side-channe...

CVE-2023-21344

CVE-2023-21344 affects Android’s Job Scheduler. The issue enables a local attacker to determine whether an app is installed via a side-channel information disclosure, without query permissions and with no user interaction. Impact is local information disclosure; exploitation requires local access...

CVE-2023-21371

CVE-2023-21371 affects Android’s Secure Element. The issue is an out-of-bounds write caused by an integer overflow in Secure Element code, enabling local escalation of privilege to System execution privileges without user interaction. Exploitation details are not provided in the connected documen...

CVE-2023-21372

CVE-2023-21372 concerns a vulnerability in libdexfile where a missing bounds check allows an out-of-bounds read, enabling local elevation of privilege without user interaction. The issue affects Android’s libdexfile component and is classified as a local EoP (MITRE ambiguous, but Android bulletin...

CVE-2023-30939

CVE-2023-30939 affects the telephony service with a missing permission check, enabling local information disclosure without extra privileges. Connected sources identify impacted platforms (e.g., UNISOC chipsets) and confirm the root cause as a lack of privilege validation in telephony components....

CVE-2023-32816

The CVE-2023-32816 entry describes a vulnerability in the gnss service where an out-of-bounds read results from improper input validation. The issue can lead to local information disclosure with system execution privileges required and does not require user interaction. A patch is identified: ALP...

CVE-2023-32849

In the provided documents, CVE-2023-32849 is tied to the cmdq module, where a type confusion causes an out-of-bounds write. This leads to local privilege escalation with System execution privileges required, and exploitation does not require user interaction. A patch/reference is listed as Patch ...

CVE-2023-32855

CVE-2023-32855 describes a privilege-escalation defect in the aee module (MediaTek context) caused by a missing permission check, enabling local escalation to System privileges without user interaction. Exploitation status is not detailed in the provided documents. A fix is referenced as Patch ID...

CVE-2023-40651

CVE-2023-40651 affects the urild service and is caused by a missing bounds check that allows an out-of-bounds write. The NVD entry notes a local denial-of-service impact with system-level execution privileges required and a CVSS v3.1 base score of 4.4 (Local, Low Attack Complexity, High Privilege...