CVE-2022-20317

CVE-2022-20317 affects Android 13 SystemUI. A logic error in SystemUI could allow local information disclosure by enabling the external speaker; exploitation requires user interaction and no extra privileges. The issue is documented across multiple sources (NVD entry, RH Red Hat CVE page, CNVD/CN...

CVE-2022-20322

CVE-2022-20322 affects Android 13 where the PackageManager may disclose installed package information due to a missing permission check. The issue enables local information disclosure without extra execution privileges and without user interaction. The vulnerability is classified as Local (ATT&CK...

CVE-2022-20362

CVE-2022-20362 : This Android 13 Bluetooth vulnerability is caused by an out-of-bounds write due to an integer overflow, enabling remote code execution with no privileges and no user interaction, exploitable by an adjacent attacker. Remediation is via Android 13 security updates (patch level 2022...

CVE-2022-26449

Summary: CVE-2022-26449 concerns the MediaTek Apusys component, with an out-of-bounds write caused by a missing bounds check that can enable local privilege escalation without user interaction. Affected component: apusys (MediaTek Apusys chipset). Root cause and impact (as stated): out-of-bounds ...

CVE-2022-26474

The CVE-2022-26474 entry describes a local privilege escalation in MediaTek sensorhub due to an out-of-bounds write from an incorrect buffer size calculation. Vulnerable component: sensorhub in affected MediaTek chips; root cause is incorrect buffer size calculation leading to out-of-bounds write...

CVE-2022-30756

The CVE-2022-30756 entry describes an implicit Intent hijacking flaw in Samsung Finder prior to the SMR July 2022 Release 1. The underlying issue is that implicit intent invocation allows unrestrained recipients, enabling an attacker to launch certain Finder-privileged activities. Impact is descr...

CVE-2022-32614

CVE-2022-32614 concerns a memory corruption flaw in Audio processing within MediaTek chipsets. The root cause is a logic error in the audio path that can allow local privilege escalation to SYSTEM level with no user interaction required. Exploitation details are not provided in the available docu...

CVE-2022-32617

CVE-2022-32617 affects the typec component in affected MediaTek hardware. The root cause is an out-of-bounds write caused by an incorrect buffer-size calculation, enabling local privilege escalation for an attacker with physical access and no extra privileges or user interaction required. The vul...

CVE-2022-32641

CVE-2022-32641 affects Meta Wifi implementations in MediaTek chipsets, with an out-of-bounds read caused by a missing bounds check. This can enable local escalation of privilege with System execution privileges required; exploitation reportedly does not require user interaction. The patch referen...

CVE-2022-32652

CVE-2022-32652 (mtk-aie) : A use-after-free due to a logic error in MediaTek mtk-aie could allow local escalation to SYSTEM privileges with no user interaction required. Affected component: mtk-aie (MediaTek) with a local-exploit path implied by the CVE description. Public details in connected do...

CVE-2022-33691

The CVE-2022-33691 entry describes a race-condition vulnerability in Samsung Mobile’s score driver (prior to SMR Jul-2022 Release 1). The issue stems from insufficient synchronization points, enabling local attackers to interleave malicious operations. Impact indicators in the sources point to lo...

CVE-2022-38677

Summary (CVE-2022-38677) : Multiple sources describe a vulnerability in the cell service caused by a missing permission check, enabling local denial of service without requiring additional privileges. Reported impact is availability degradation; CVSSv3.1 base score ~5.5 (Medium) with local attack...

CVE-2022-39088

CVE-2022-39088 : A missing permission check in a network service affecting UNISOC chipsets can lead to local privilege escalation to SYSTEM execution privileges. The entry lacks explicit affected product versions or a published fix in the provided documents. Exploitation status is not disclosed. ...

CVE-2022-39095

CVE-2022-39095 corresponds to a vulnerability in the power management service where a missing permission check allows setting up the service with no additional execution privileges. Reported as local access with low privileges required and no user interaction, and with impact on confidentiality, ...

CVE-2022-39096

CVE-2022-39096: A missing permission check in the power management service is documented, potentially allowing setup of the service with no additional execution privileges. Affected context across multiple sources centers on a local-privilege scenario with high impact (confidentiality, integrity,...

CVE-2022-39112

CVE-2022-39112 describes a vulnerability in the Music service where a missing permission check can lead to local denial of service with no additional execution privileges required. The issue is consistently described across multiple sources (NVD/Red Hat/PRION/CNVD/etc.) as a lack of access contro...

CVE-2022-39127

The CVE-2022-39127 entry concerns a vulnerability in a sensor driver where a missing bounds check can cause an out-of-bounds write, leading to local denial of service in the kernel. The issue is described across multiple sources (NVD/Red Hat/CNNVD) as affecting the sensor driver (kernel level); C...

CVE-2022-44433

The connected sources describe CVE-2022-44433 as a vulnerability in UNISOC Chipsets’ phoneEx service module where a missing permission check allows local escalation of privilege with no additional execution privileges. The issue is tied to the phoneEx service component and is characterized by a l...

CVE-2022-47369

CVE-2022-47369 concerns a vulnerability in the WLAN driver where a missing parameters check could allow local denial of service to WLAN services. The issue is described across multiple sources as affecting the WLAN driver and enabling local impact, with the root cause identified as inadequate val...

CVE-2022-47371

The CVE-2022-47371 issue affects the bt driver (kernel component). A thread competition causes resources to be released early, which can enable local denial of service in the kernel. Documents consistently describe the vulnerability and impact as local DoS but do not provide confirmed exploit det...

CVE-2022-48231

Summary (CVE-2022-48231): The vulnerability is described as a missing permission check in the soter service, leading to local denial of service with no additional execution privileges. Public references indicate the issue in the UNISOC/“Soter service” used in chipsets and related Red Hat/NVD reco...

CVE-2022-48244

CVE-2022-48244 affects UNISOC chipsets’ audio service, with a missing permission check as the root cause. This could enable local escalation of privilege with no additional execution privileges, aligning with the CVSS 3.1 base metrics (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 7.8). Exploit...

CVE-2022-48370

CVE-2022-48370 describes a local information disclosure in the Unisoc dialer service due to a missing permission check. The vulnerability affects Unisoc chipsets’ dialer component and could allow access to sensitive data without extra execution privileges. No explicit affected version ranges or p...

CVE-2023-20610

CVE-2023-20610 describes a memory corruption risk in the MediaTek display DRM stack caused by a race condition, enabling local escalation of privilege with System execution privileges required and no user interaction. The vulnerability affects the display DRM component; the root cause is a race c...

CVE-2023-20663

CVE-2023-20663 describes a potential out-of-bounds write in wlan due to an integer overflow, enabling local privilege escalation with System execution privileges required and no user interaction. The vulnerability is tied to a patch ID ALPS07560741 / Issue ID ALPS07560741. Connected sources menti...

CVE-2023-20674

The CVE-2023-20674 issue affects the WLAN component in MediaTek devices, caused by an out-of-bounds read due to a missing bounds check. This vulnerability could allow local information disclosure and may enable system-level execution privileges, with no user interaction required. Multiple feeds (...

CVE-2023-20676

CVE-2023-20676 is an out-of-bounds read vulnerability in the WLAN component of MediaTek devices (notably affecting Mediatek WLAN stacks such as MT5221 and similar chips). The underlying issue is a missing bounds check, enabling local information disclosure and, per the description, potentially al...

CVE-2023-20723

Summary of CVE-2023-20723 : A Bluetooth vulnerability in MediaTek-based devices allows an out-of-bounds read due to a missing bounds check, enabling local escalation of privilege with System execution privileges required. Exploitation is described as local with no user interaction needed; the ent...

CVE-2023-20833

The CVE-2023-20833 issue concerns MediaTek devices featuring the keyinstall component. A missing bounds check in keyinstall is reported to cause local information disclosure, with the prerequisite that system execution privileges are required and no user interaction is needed for exploitation. Th...

CVE-2023-21229

CVE-2023-21229 concerns Google Wear OS (Framework/ManagedServices.java: registerServiceLocked) where an unsafe PendingIntent can bypass background activity launch restrictions. This vulnerability enables local escalation of privilege with no additional privileges and no user interaction required,...

CVE-2023-21321

CVE-2023-21321 affects Android's Package Manager, enabling cross-user information disclosure due to a missing permission check. The vulnerability allows local information disclosure with no privileges and no user interaction required. The connected sources list this CVE as part of Android 14 secu...

CVE-2023-21324

CVE-2023-21324 is listed in Android 14 release notes under the Framework section as an elevation-of-privilege (EoP) vulnerability with moderate severity. The exact affected packages/versions are not detailed in the provided sources, but the Android bulletin states these issues are fixed in Androi...

CVE-2023-21335

CVE-2023-21335 affects Android, describing a side-channel in Settings that allows determining if an app is installed without query permissions. The vulnerability enables local information disclosure with no extra privileges and no user interaction required. Connected sources (RH security advisory...

CVE-2023-21337

CVE-2023-21337 affects the Android InputMethod component and describes an information-disclosure side channel that can reveal whether an app is installed. This leads to local elevation of privilege with no extra execution privileges and no required user interaction, per the description in the NVD...

CVE-2023-21361

CVE-2023-21361 affects the Android Bluetooth stack, where a use-after-free in the Bluetooth component can allow code execution in the privileged Bluetooth process. The vulnerability enables an attacker with adjacent access to trigger execution with no additional privileges or user interaction, le...

CVE-2023-21379

CVE-2023-21379 (Android Bluetooth information disclosure) is described as a Bluetooth vulnerability with an out-of-bounds read caused by a missing bounds check, enabling local information disclosure. The issue affects Bluetooth handling on Android, requiring System privileges for exploitation, wi...

CVE-2023-32811

CVE-2023-32811 affects the connectivity system driver. The root cause is an out-of-bounds write due to improper input validation, enabling local escalation to SYSTEM with no user interaction. Exploitation status is not fully detailed in the provided documents, but a patch (Patch ID: ALPS07929848;...

CVE-2023-33907

The CVE-2023-33907 issue is described across multiple sources as a flaw in the Contacts Service where a missing permission check can allow local information disclosure without requiring additional execution privileges. The Red Hat entry explicitly notes a missing permission check as the root caus...

CVE-2023-33909

CVE-2023-33909 describes a missing permission check in the Contacts service module on UNISOC chipsets, enabling potential local information disclosure without extra privileges. According to NVD, the issue has CVSS v3.1: base score 5.5 (Impact: Confidentiality High; Attack Vector: Local; Privilege...

CVE-2023-33911

CVE-2023-33911 affects the vowifi service in UNISOC-based environments. Root cause: a missing permission check leading to local information disclosure without additional execution privileges. Impact: confidentiality breach (local access, high impact) without integrity or availability impact per t...

CVE-2023-42632

The CVE-2023-42632 issue affects validationtools, where a missing permission check could allow local information disclosure without requiring any additional execution privileges. Documented impact is limited to disclosure (Confidentiality Impact: HIGH) with local attack vector and no user interac...

CVE-2023-42647

CVE-2023-42647 affects the Ifaa service. The root cause is a missing permission check that allows writing permission usage records for apps, leading to local information disclosure without additional execution privileges. Adverse impact is confined to information disclosure (confidentiality) with...

CVE-2023-52346

CVE-2023-52346 affects the modem driver in UNISOC chipsets, where improper input validation can cause a system crash and may enable local information disclosure with system execution privileges required. The NVD entries describe the vulnerable component as the modem driver and note a potential lo...

CVE-2024-0028

The CVE-2024-0028 entry describes an information-disclosure flaw in Android’s Audio Service where a missing permission check could let an attacker obtain the MAC addresses of nearby Bluetooth devices. This is a local issue with low attack complexity and no user interaction required, potentially e...

CVE-2024-20117

The CVE-2024-20117 issue affects the vdec component, where an out-of-bounds read caused by improper structure design can lead to local information disclosure with SYSTEM privileges required and no user interaction. Public data confirms the vulnerability details across multiple feeds (NVD/Red Hat/...

CVE-2026-0142

CVE-2026-0142 affects the AVB component (iavb_parse_key_data in avb_rsa.c). The root cause is an out-of-bounds read due to improper input validation, leading to local information disclosure without extra privileges or user interaction. Connected documents confirm the same description across multi...

CVE-2009-3698

CVE-2009-3698 describes a vulnerability in the Dalvik API used by Android 1.5 and earlier. An unspecified function in the Dalvik API can be triggered by a crafted application to cause a denial of service (system process restart). The issue is potentially related to CVE-2009-2656, indicating a fam...

CVE-2014-8610

The CVE describes a vulnerability in Android prior to 5.0.0 where AndroidManifest.xml does not require SEND_SMS for the SmsReceiver, allowing an unprivileged app to cause stored SMS messages to be resent or new draft SMS messages to be sent by broadcasting the com.android.mms.transaction.MESSAGE_...

CVE-2014-9867

The CVE-2014-9867 issue affects Qualcomm camera components in Android (Nexus 5/7 2013) where msm_isp_axi_util.c fails to validate the number of streams, enabling privilege escalation via a crafted app. Root cause: missing validation in the camera driver path. Impact: local privilege escalation wi...

CVE-2014-9883

CVE-2014-9883 describes an integer overflow in drivers/char/diag/diag_dci.c within the Qualcomm component used by Android on Nexus 5 and Nexus 7 (2013) devices, before the 2016-08-05 patch. The vulnerability could allow a crafted application to gain privileges or access sensitive information. Pub...