CVE-2023-21057

CVE-2023-21057 affects the Android kernel component RohcPacketCommon, specifically the function path in ProfSixDecomTcpSACKoption. The issue is an out-of-bounds write caused by a missing bounds check, which could allow remote code execution without any privileges or user interaction. The vulnerab...

CVE-2019-2054

CVE-2019-2054 involves a seccomp bypass in the Android/Linux kernel prior to 4.8, where seccomp policies allow ptrace usage. This could enable local privilege escalation without additional execution privileges and without user interaction. The core issue is that certain seccomp policies permit pt...

CVE-2020-0068

CVE-2020-0068 affects the Android kernel audio driver (msm-cirrus-playback.c) via crus_afe_get_param, causing an out-of-bounds read due to an integer overflow. This can lead to local information disclosure with System privileges required; exploitation does not require user interaction. Documented...

CVE-2021-39715

The CVE refers to an information disclosure in the Android kernel: in __show_regs of process.c, log information disclosure could leak kernel memory/addresses, enabling local information leakage with SYSTEM privileges. Affected software: Android kernel components; vulnerable item: the show_regs pa...

CVE-2022-20117

Mode C: CVE-2022-20117 affects Pixel devices with Titan M (per Pixel Update Bulletin). The Titan M ID vulnerability indicates an information-disclosure issue where local data encrypted by the GSC can be decrypted due to improper crypto usage. Impact is local information disclosure without extra e...

CVE-2020-0075

CVE-2020-0075 affects the FPC Iris TZ App within Android (FPC component). Description: out-of-bounds read due to a missing bounds check in set_shared_key, enabling local information disclosure with System privileges required; no user interaction needed. Mode: Normal (concrete details provided). C...

CVE-2021-0924

CVE-2021-0924 affects the Android kernel USB stack, specifically the xhci driver. In xhci_vendor_get_ops of xhci.c, a missing bounds check enables an out-of-bounds read. This could allow local escalation of privilege with no additional execution privileges required and without user interaction. P...

CVE-2022-20568

CVE-2022-20568 describes a use-after-free in the Android kernel that could corrupt kernel memory and enable local escalation of privileges without user interaction; exploitation is reported as local, with no additional privileges or interaction required. The connected security bulletins (EulerOS/...

CVE-2024-32929

A use after free vulnerability exists in the gpu_slc_get_region function of pixel_gpu_slc.c within the Pixel GPU Driver . This flaw could lead to a local escalation of privilege (EoP) without requiring additional execution privileges or user interaction. The issue specifically affects Google Pixe...

CVE-2020-0077

CVE-2020-0077 affects the FPC Iris TZ App (TrustZone) on Android. Description: an out-of-bounds read in authorize_enroll due to a missing bounds check, enabling local information disclosure with System privileges needed; exploitation does not require user interaction. Connected sources corroborat...

CVE-2021-0935

The CVE-2021-0935 entry concerns the Linux kernel IPv6 path: in ip6_xmit() within ip6_output.c, an out-of-bounds write can occur due to a use-after-free, enabling locally escalated privileges with SYSTEM/root rights. Exploitation details are not provided in the supplied documents. Some connected ...

CVE-2022-20567

The Linux kernel contains a use-after-free vulnerability in the L2TP implementation. This issue stems from a race condition occurring when releasing PPPoL2TP sockets in specific conditions, specifically within the pppol2tp_create function of l2tp_ppp.c. A local attacker could exploit this to caus...

CVE-2023-45779

CVE-2023-45779 affects the AOSP APEX module framework. The root cause is the improper use of crypto, enabling a malicious update to platform components and resulting in local privilege escalation with no extra execution privileges required. No user interaction is needed for exploitation. The vuln...

CVE-2018-9383

A buffer overflow vulnerability exists in the asn1_ber_decoder function of asn1_decoder.c , caused by a lack of bounds checking. This flaw can lead to out-of-bounds reads of memory, potentially resulting in local information disclosure . Exploitation requires System execution privileges and does ...

CVE-2020-0259

CVE-2020-0259 affects the Android kernel AMLogic dm-verity component (dm-android-verity.c). The vulnerability arises from improper crypto usage in android_verity_ctr, allowing a local attacker to modify a dm-verity protected filesystem and gain elevation of privilege with no additional execution ...

CVE-2022-20399

CVE-2022-20399 concerns the SEPolicy configuration in Android system apps, where an insecure default value allows access to the non-setuid ip utility. The resulting impact is local information disclosure of network data without extra privileges or user interaction. Documents consistently tie this...

CVE-2021-0581

CVE-2021-0581 affects the Android Wi-Fi driver (Android SoC) and is described as an out-of-bounds read caused by a missing bounds check, enabling remote information disclosure to a proximal attacker without extra privileges or user interaction. The issue is documented across multiple feeds (NVD, ...

CVE-2022-20120

CVE-2022-20120 is a bootloader remote code execution vulnerability affecting Android Pixel devices. The Pixel Update Bulletin Groups this CVE under Bootloader with a Critical severity and indicates that security patch levels of 2022-05-05 or later address the issue. The available documents provid...

CVE-2023-21401

CVE-2023-21401 : Concrete details across connected docs show an out-of-bounds write in the Linux kernel component DevmemIntChangeSparse within devicemem_server.c caused by an integer overflow. This can enable local escalation of privilege with no extra execution privileges or user interaction req...

CVE-2021-0961

CVE-2021-0961 affects the Android kernel via quota_proc_write in xt_quota2.c, enabling information disclosure by reading kernel memory due to uninitialized data. Impact is local: requires SYSTEM privileges with local access; user interaction is not required. Affected product scope is Android kern...

CVE-2021-39718

CVE-2021-39718 concerns the Android kernel component ProtocolStkProactiveCommandAdapter (file protocolstkadapter.cpp). A possible out-of-bounds write caused by an incorrect bounds check is reported, which could enable local escalation of privilege with System execution privileges needed. Exploita...

CVE-2022-20122

The CVE-2022-20122 entry concerns the PowerVR GPU driver in Android devices. The vulnerability allows unprivileged apps to allocate pinned memory, unpin it to free it, and continue using the page in GPU calls without any privileges, leading to kernel memory corruption. Reported impact is high (CV...

CVE-2015-8546

Concrete details: CVE-2015-8546 affects Samsung mobile devices with Shannon333 baseband (Galaxy S6/S6 Edge/S6 Edge+/Note5) and firmware up to 2015-11-12. Vulnerability is a stack-based buffer overflow in the baseband process, enabling remote code execution via a fake base station. Exploitation st...

CVE-2024-43077

Google Android is impacted by an out-of-bounds write vulnerability in the DevmemValidateFlags function of the devicemem_server.c file. The root cause is a lack of boundary checking , which can lead to memory corruption. This vulnerability allows for local escalation of privilege without requiring...

CVE-2021-0698

CVE-2021-0698 involves a leak of kernel heap content in PVRSRVBridgeHeapCfgHeapDetails due to uninitialized data, enabling local information disclosure without extra privileges or user interaction. Affected component/driver appears to be PowerVR-GPU (Imagination Technologies) within Android envir...

CVE-2021-0877

CVE-2021-0877 is linked in connected documents to Imagination Technologies as an issue affecting PowerVR-GPU on Android SoC. The CVE entry carries a high severity (CVSSv3.1 base score 9.8, CRITICAL) with network attack vector, no user interaction, and impact to confidentiality, integrity, and ava...

CVE-2022-20217

CVE-2022-20217 stems from an authorization weakness in Android’s SprdContactsProvider, enabling a third-party app to trigger an unauthorized broadcast that could delete FDN contacts. Connected sources (PT-2022-4134, NVD entry) confirm the vulnerability in SprdContactsProvider with Android telepho...

CVE-2017-13167

CVE-2017-13167 is described as an elevation of privilege vulnerability in the kernel sound timer affecting the Android kernel. The provided connected document notes the product as Android and versions as the Android kernel, with Android ID A-37240993. The Unity Linux/UTSA advisories reference thi...

CVE-2021-0639

CVE-2021-0639 affects Android/Widevine through libl3oemcrypto.cpp. Described as a local information disclosure due to weaknesses in the obfuscation/handling of sensitive data; requires no user interaction. Documented impact is partial confidentiality loss with local access and no privileges beyon...

CVE-2022-20118

CVE-2022-20118 affects the Android kernel ion.c, specifically in ion_ioctl and related functions, where a race condition can trigger a use-after-free. This leads to local privilege escalation without extra execution privileges or user interaction. Documented impact appears as EoP with local acces...

CVE-2023-21120

CVE-2023-21120 affects Android components, notably cdm_engine.cpp, where a use-after-free caused by improper locking could enable local privilege escalation with no required user interaction. The vulnerability is documented across multiple feeds (NVD/Red Hat/NCSC/OSV) with Android context; exploi...

CVE-2021-39648

CVE-2021-39648 affects the Linux kernel gadget code path: the function gadget_dev_desc_UDC_show in configfs.c may disclose kernel heap memory due to a race condition, enabling local information disclosure with SYSTEM privileges (no user interaction required). Publicly documented references in And...

CVE-2021-39717

CVE-2021-39717 affects the Android kernel component iaxxx-btp.c (function iaxxx_btp_write_words). The issue is an out-of-bounds read caused by an incorrect bounds check, leading to local information disclosure with System privileges required. No exploitation details or user interaction informatio...

CVE-2023-21101

CVE-2023-21101 concerns a race condition in WVDrmPlugin.cpp that leads to a use-after-free, enabling local escalation of privilege. The vulnerability is described as requiring no user interaction and enabling exploitation locally, with the Android Widevine DRM component implicated. The linked doc...

CVE-2024-22012

CVE-2024-22012 : A Google Pixel-related out-of-bounds write due to a missing bounds check can lead to local privilege escalation without user interaction. Affected component: Pixel bootloader (per Pixel Update Bulletin).CVSS shows LOCAL access, LOW exploit complexity, and HIGH confidentiality/int...

CVE-2018-9384

CVE-2018-9384 identifies a vulnerability in the Kernel component of Google Pixel and Nexus devices. The flaw allows an attacker with System execution privileges to bypass KASLR (Kernel Address Space Layout Randomization) due to an unusual root cause, potentially leading to local information discl...

CVE-2023-48409

Summary: CVE-2023-48409 affects the Mali KBase GPU kernel module on Google Pixel devices. The vulnerability is described as a possible out-of-bounds write triggered by an integer overflow in the function gpu_pixel_handle_buffer_liveness_update_ioctl within private/google-modules/gpu/mali_kbase/ma...

CVE-2021-0399

Summary: CVE-2021-0399 is a memory corruption use-after-free in Android kernel’s xt_qtaguid.c (qtaguid_untag). The issue can lead to local escalation of privilege with no extra execution privileges or user interaction. The vulnerable component is the kernel’s qtaguid path; exploitation is local, ...

CVE-2022-20153

Summary (CVE-2022-20153) In the Android kernel, the vulnerability occurs in the function rcu_cblist_dequeue of rcu_segcblist.c , where improper locking can cause a use-after-free. This can enable local escalation of privilege with SYSTEM execution privileges required, and exploitation does not re...

CVE-2022-20216

CVE-2022-20216 concerns an Android risk where the exported attribute is used to grant third‑party app access permissions; the default intent-filter is true and com.sprd.firewall has set exported to true. The vulnerability is tied to Android devices with a vulnerable Telephony/OSC component (Andro...

CVE-2022-20385

CVE-2022-20385 affects Android and is tied to a nla_parse path that does not validate para length. Userspace can influence nla_type via maxtype (GSCAN_MAX) and trigger OOB access to the policy[type] array. This is described across multiple sources as a kernel/Android issue with potential for loca...

CVE-2023-21165

CVE-2023-21165 concerns a use-after-free in the DevmemIntUnmapPMR function of devicemem_server.c, leading to possible arbitrary code execution and local privilege escalation in the kernel. Multiple connected sources corroborate the issue and its kernel-level impact, with the vulnerability enablin...

CVE-2024-31335

The CVE-2024-31335 entry concerns a logic error in DevmemIntChangeSparse2 within devicemem_server.c that can enable arbitrary code execution with local privilege elevation in the kernel. Connected sources indicate affected components include Android’s kernel-related stack and PowerVR-GPU subcompo...

CVE-2018-9464

CVE-2018-9464 is an Elevation of Privilege (EoP) vulnerability affecting the Taimen bootloader component within the Google Android Kernel . The root cause is a missing permission check in multiple locations, which allows an attacker to read protected files. This flaw can be exploited to achieve l...

CVE-2022-20432

CVE-2022-20432 is documented in multiple feeds with concrete technical details: it targets UNISOC components in the Android Telephony stack, where a missing authorization check in a system service leads to Local Elevation of Privilege. The UNISOC entry places the vulnerability under Telephony wit...

CVE-2021-0301

CVE-2021-0301 affects the Android ged component. The root cause is a missing bounds check that allows an out-of-bounds write, leading to local escalation of privilege with System-level execution privileges required. Exploitation does not require user interaction. Multiple connected sources (NVD, ...

CVE-2021-0579

CVE-2021-0579 affects the Android WiFi driver. The issue is an out‑of‑bounds read caused by a missing bounds check, enabling remote information disclosure to a proximal attacker with no additional privileges and no user interaction required. This is the concrete vulnerability detail reported acro...

CVE-2021-0696

CVE-2021-0696 describes a use-after-free race in dllist_remove_node (TBD) leading to local privilege escalation on Android SoC. Connected records corroborate a race condition in dllist_remove_node with local-privilege escalation, affecting Android components (PowerVR-GPU listed in PT-2022-9122) a...

CVE-2021-39688

The CVE-2021-39688 entry concerns the Android kernel, with an out-of-bounds read vulnerability that could allow local information disclosure without requiring additional privileges and without user interaction. The affected area is described as Android kernel components, affecting Android-based d...

CVE-2021-39721

CVE-2021-39721 affects the Android kernel. The connected records specify a vulnerability described as an out-of-bounds write caused by memory corruption, enabling local escalation of privilege with System execution privileges required. Public references consistently cite Android kernel as the aff...