CVE-2022-20173

Technical details about CVE-2022-20173 are not provided in the supplied documents. No specifics on affected components or impact. Monitor for updates.

CVE-2022-20182

CVE-2022-20182 concerns the Android kernel component handle_ramdump inside pixel_loader.c. The vulnerability arises from a missing permission check, enabling creation of a ramdump of non-secure memory and potentially leading to local information disclosure with SYSTEM privileges required. Exploit...

CVE-2022-20193

Summary: CVE-2022-20193 affects Android 12L, in getUniqueUsagesWithLabels of PermissionUsageHelper.java, where a logic error could cause incorrect permission attribution. This may allow local escalation of privilege by conflating apps with User execution privileges. Impact : requires user interac...

CVE-2022-20403

CVE-2022-20403 targets Google Pixel devices via the Android modem component. The Pixel security bulletin classifies it as RCE (critical) in the Modem with a high impact; the NVD entry records a CVSSv3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The initial records list Product: And...

CVE-2022-20514

CVE-2022-20514 affects Android 13 and is tied to the Idmap2Service.cpp code path. The issue is an out-of-bounds write caused by a use-after-free in acquireFabricatedOverlayIterator, nextFabricatedOverlayInfos, and releaseFabricatedOverlayIterator, which could enable local escalation of privilege ...

CVE-2022-21747

CVE-2022-21747 affects the imgsensor component in MediaTek-based devices. A missing bounds check enables out-of-bounds reads, which could cause local denial of service with system privileges required. The vulnerability does not require user interaction for exploitation. A patch is referenced as A...

CVE-2022-24928

CVE-2022-24928 describes a security misconfiguration in Samsung’s RKP (kernel protection) mechanism prior to the SMR Mar-2022 Release 1. The root cause is a misconfiguration that leaves the system not protected by RKP. As a result, confidentiality, integrity, and availability can be affected on a...

CVE-2022-25822

Technical details about CVE-2022-25822 are not publicly available in the provided documents; monitor for updates.

CVE-2022-42542

CVE-2022-42542 affects Android 13 via the phNxpNciHal_core_initialized function in phNxpNciHal.cc, where a missing bounds check allows an out-of-bounds write that could enable local escalation of privilege with System execution privileges. Exploitation status is not detailed in the provided docum...

CVE-2023-20994

CVE-2023-20994 affects Android 13 via an out-of-bounds write in the function _ufdt_output_property_to_fdt in ufdt_convert.c. The vulnerability stems from an incorrect bounds check, enabling a local escalation of privilege with System execution privileges required and no user interaction. The avai...

CVE-2023-21075

CVE-2023-21075 affects the Android kernel; the vulnerability is in get_svc_hash inside nan.cpp, caused by an out-of-bounds write due to a heap buffer overflow. The impact is local elevation of privilege with System-level execution privileges required; exploitation is possible without user interac...

CVE-2023-21163

CVE-2023-21163 : A use-after-free in the PowerVR GPU driver PMR_ReadBytes (pmr.c) can enable arbitrary code execution and local kernel privilege escalation without user interaction. Exploitation details are not provided in the documents; no patch/version details are disclosed here. Affected: Powe...

CVE-2023-21227

CVE-2023-21227 describes an information disclosure in Android’s HTBLogKM in htbserver.c that can lead to local kernel information disclosure without extra privileges or user interaction. Publicly documented by NVD/Red Hat/CNVD and reflected in the Android Security Bulletin, this issue affects And...

CVE-2023-21395

CVE-2023-21395 involves a Bluetooth use-after-free bug that can trigger an out-of-bounds read, enabling remote information disclosure without user interaction or additional privileges. The vulnerability is documented across multiple feeds (NVD entry authoring the Bluetooth impact; Red Hat and oth...

CVE-2023-32848

CVE-2023-32848 affects MediaTek vdec (Video Decoder) with a type confusion that enables an out-of-bounds write. The described impact is local escalation of privilege requiring System execution privileges, with no user interaction needed. Public details confirm the vulnerability is tied to ALPS081...

CVE-2023-35690

CVE-2023-35690 affects RGXDestroyHWRTData in rgxta3d.c and can cause arbitrary code execution leading to local kernel privilege escalation with no user interaction. Connected sources confirm the issue and its kernel-level impact; no exploit details are provided beyond that. Android’s December 202...

CVE-2023-48348

CVE-2023-48348 concerns an issue in a video decoder where improper input validation can cause an out-of-bounds write, leading to a local denial of service with no extra privileges. The Red Hat and NVD entries describe the same vulnerability, and Android-related advisories (including Unisoc-listed...

CVE-2024-29786

CVE-2024-29786 describes a potential remote code execution in Google Pixel devices due to an out-of-bounds write in the function pktproc_fill_data_addr_without_bm within link_rx_pktproc.c caused by a missing bounds check. The issue affects Pixel firmware/CPIF as listed in the Pixel bulletin; the ...

CVE-2024-32894

The CVE-2024-32894 entry describes a likely out-of-bounds read in bc_get_converted_received_bearer of bc_utilities.c, enabling remote information disclosure with no privileges or user interaction. Multiple connected records (Red Hat, NVD, OSV, CNNVD) reiterate the same root cause and impact, with...

CVE-2014-9870

The CVE-2014-9870 entry concerns the Linux kernel prior to 3.11 on ARM, including Android devices (Nexus 5/7) before 2016-08-05. It exposes a privilege-escalation path via improper handling of user-space access to the TPIDRURW register, enabling local attackers to gain privileges with a crafted a...

CVE-2015-3096

CVE-2015-3096 relates to Adobe Flash Player and related AIR components; connected sources indicate a CSRF issue linked to an incomplete fix for CVE-2014-5333, enabling CSRF via crafted SWF/OBJECT content and potentially bypassing protections. Details about affected versions are provided in adviso...

CVE-2015-6676

CVE-2015-6676 is a buffer overflow vulnerability in Adobe Flash Player and related AIR components. Affected: Flash Player on Windows/macOS prior to 18.0.0.241 and 19.x prior to 19.0.0.185, Linux prior to 11.2.202.521; AIR before 19.0.0.190 and AIR SDK/Compiler before 19.0.0.190. Description notes...

CVE-2018-5873

The CVE-2018-5873 entry refers to a race-condition induced Use-After-Free in the Linux kernel before 4.11, specifically in __ns_get_path within fs/nsfs.c. This affects the mainline Linux kernel and Android builds derived from CAF for Android kernels (Android for MSM, Firefox OS for MSM, QRD Andro...

CVE-2018-9352

CVE-2018-9352 affects the ihevcd_allocate_dynamic_bufs function in ihevcd_api.c. The vulnerability is a resource exhaustion due to an integer overflow, potentially enabling remote denial of service with no code execution required. Exploitation requires user interaction. Connected sources (Red Hat...

CVE-2018-9390

CVE-2018-9390 involves an out-of-bounds read in procfile_write within gl_proc.c caused by an incorrect bounds check, enabling local privilege escalation with SYSTEM rights. Exploitation is not user-initiated. Reports from NVD/Red Hat/CNNVD mirror a consistent description across Android Pixel devi...

CVE-2019-2017

CVE-2019-2017 : In rw_t2t_handle_tlv_detect_rsp of rw_t2t_ndef.cc, there is a possible out-of-bounds write due to a missing bounds check, enabling local elevation of privilege with no additional execution privileges required. Exploitation requires user interaction. Affected are Android versions 7...

CVE-2019-2018

CVE-2019-2018 affects Android devices via a bypass in resetPasswordInternal in DevicePolicyManagerService.java. The vulnerability allows bypass of password reset protection, with remote exploitation requiring user interaction. Affected Android versions are 8.1 and 9. The issue is documented in th...

CVE-2020-0051

CVE-2020-0051 affects Android 10 System via a tapjacking vulnerability in SettingsHomepageActivity. Root cause: tapjacking could enable local elevation of privilege with no extra execution privileges; exploitation requires user interaction (UI). CVSSv3.1 base score 7.8 (HIGH), CVSSv2 4.4 (MEDIUM)...

CVE-2020-11836

Technical details about CVE-2020-11836 are not provided in the supplied documents; no specifics on affected components, root cause, or fixes are publicly available. Monitor for updates.

CVE-2020-13839

CVE-2020-13839 describes a buffer overflow in a custom AT command handler on LG mobile devices running Android OS 7.2, 8.x, 9, and 10 with MTK chipsets. The underlying issue is a code execution vulnerability caused by improper handling of AT commands, allowing an attacker to execute arbitrary cod...

CVE-2021-0606

CVE-2021-0606 concerns the Android kernel DRM driver, specifically the function drm_syncobj_handle_to_fd in drm_syncobj.c. The issue is a use-after-free caused by incorrect refcounting, which can allow local escalation of privilege with system execution privileges required. User interaction is no...

CVE-2021-0880

CVE-2021-0880 involves the PowerVR kernel driver’s PVRSRVBridgeRGXKickTA3D, where a missing size check can trigger an integer overflow and out-of-bounds heap access. This enables local escalation of privilege with no additional execution privileges required and without user interaction. Connected...

CVE-2021-39760

CVE-2021-39760 is described as a side-channel information disclosure in Android’s AudioService that can reveal whether an app is installed without query permissions. The impact is local information leakage with no extra execution privileges; user interaction is not required. Related connected doc...

CVE-2022-20031

CVE-2022-20031 affects the fb driver with a use-after-free leading to memory corruption and local privilege escalation. Exploitation is reported to require no user interaction. Patch ALPS05850708/ALPS05850708 corrects the issue. Demonstrated impact is restricted to the described local escalation ...

CVE-2022-20054

The CVE-2022-20054 issue affects the ims service, with a missing permission check enabling a possible AT command injection that could allow local escalation of privilege without additional execution privileges or user interaction. Affected context is MediaTek-based platforms (as per multiple sour...

CVE-2022-20078

CVE-2022-20078 affects vow with a memory corruption flaw caused by a race condition, enabling local privilege escalation to System level without user interaction. Exploitation details are not provided in the initial documents; confirmed remediation reference is Patch ID ALPS05852819 / Issue ALPS0...

CVE-2022-20183

CVE-2022-20183 affects the Android kernel, specifically the hypx_create_blob_dmabuf path in faceauth_hypx.c. The issue is a missing bounds check that leads to an out-of-bounds write. This could enable local escalation of privilege with System execution privileges required; no user interaction is ...

CVE-2022-20207

CVE-2022-20207 affects Android 12L via the static definition in GattServiceConfig.java , where an insecure default value permits a permission bypass leading to local elevation of privilege without user interaction. The issue is described across multiple sources (Android/Red Hat/NVD entries) as a ...

CVE-2022-20231

CVE-2022-20231 affects the Android kernel on at least some Pixel/Android devices. The issue is an out-of-bounds write in smc_intc_request_fiq within arm_gic.c, caused by improper input validation, enabling local escalation of privilege with System execution privileges required; no user interactio...

CVE-2022-20404

CVE-2022-20404 is listed in Pixel bulletin data as affecting Android devices via the Modem component (Type: Information disclosure; Severity: Moderate). The vulnerable entry maps to CVE-2022-20404 with Android kernel context in the initial doc, but Pixel security bulletin categorizes it under the...

CVE-2022-20443

CVE-2022-20443 concerns Android 13 where the hasInputInfo function in Layer.cpp may bypass user interaction via a tapjacking/overlay attack, enabling local escalation of privilege with no extra execution privileges and no user interaction required for exploitation. Affected product: Android 13 (A...

CVE-2022-20524

The CVE-2022-20524 issue affects Android 13 devices due to a use-after-free in Vibrator.cpp, enabling arbitrary code execution and local privilege escalation without extra user interaction. The vulnerability is classified as a LOCAL, low-privilege issue with high confidentiality, integrity, and a...

CVE-2022-20543

CVE-2022-20543 affects Android-13 on Google Pixel devices. The issue is a display crash loop caused by improper input validation in multiple locations, enabling local denial of service with system execution privileges required. Exploitation is local with no user interaction. The Pixel bulletin in...

CVE-2022-20556

The provided documents confirm CVE-2022-20556 affects Android 13, where a missing permission check in launchConfigNewNetworkFragment of NetworkProviderSettings.java allows a guest user to add a new WiFi network. This enables local elevation of privilege with no extra execution privileges required...

CVE-2022-23729

CVE-2022-23729 affects LG mobile devices when in factory state, allowing shell access without adb authentication. The issue is described consistently across multiple sources (NVD, Red Hat, CVE records, CNNVD) as an authentication flaw enabling direct shell access in factory mode. The Root Cause a...

CVE-2022-25817

Samsung One UI Home (pre–SMR Mar‑2022 Release 1) is affected by CVE-2022-25817 due to improper authentication, allowing an attacker to generate pinned shortcuts without user consent. Remediation: update to SMR Mar‑2022 Release 1 or later.

CVE-2022-42526

The CVE-2022-42526 entry concerns an out-of-bounds write in ConvertUtf8ToUcs2 within radio_hal_utils.cpp, tied to the Android kernel. The root cause is a missing bounds check in that function, which could allow a local escalation of privilege with System privileges required; exploitation is descr...

CVE-2022-48459

CVE-2022-48459 affects TeleService, where improper input validation can trigger a system crash, causing local denial of service without requiring additional privileges. The NVD entry records a CVSS v3.1 base score of 5.5 (Attack Vector: Local, Attack Complexity: Low, Privileges Required: Low, Use...

CVE-2023-21047

CVE-2023-21047 affects Android kernel, with the issue localized to ConvertToHalMetadata in aidl_utils.cc where a missing bounds check enables an out-of-bounds read. This can lead to local information disclosure with system-level privileges required for exploitation and does not require user inter...

CVE-2023-21052

CVE-2023-21052 affects the Android kernel component ril_external_client.cpp (setToExternal). The issue is an out-of-bounds write caused by a missing bounds check in that function, enabling local privilege escalation with system-level execution privileges and no user interaction required. Exploita...