CVE-2021-39727

CVE-2021-39727 describes an information-disclosure vulnerability in Android’s acropora/app/identity/libeic/EicPresentation.c, caused by a race condition in the function eicPresentationRetrieveEntryValue . The issue can enable local information disclosure with System-level privileges and does not ...

CVE-2021-39732

CVE-2021-39732 affects the Android kernel component copy_io_entries in lwis_ioctl.c. It describes an out-of-bounds write caused by an integer overflow, which could enable local privilege escalation without user interaction. The available connected documents confirm the issue’s presence in Android...

CVE-2021-39736

CVE-2021-39736 affects the Android kernel: in lwis_ioctl.c and lwis_periodic_io.c, an integer overflow can cause an out-of-bounds write, enabling local elevation of privileges with SYSTEM access. Exploitation details are not provided in the documents, and no user interaction is required for explo...

CVE-2021-39815

CVE-2021-39815 concerns the PowerVR-GPU driver in Android. Unprivileged apps can allocate pinned memory, unpin it, and continue using the page in GPU calls, allowing kernel memory corruption without privileges. CVSSv3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H assigns a base score of 9.8 (CRITICAL) wi...

CVE-2022-20236

CVE-2022-20236 is referenced in the Android Security Bulletin under Unisoc GPU; the affected component is a UNISOC GPU driver. The underlying root cause and specific impact are not detailed in the provided documents. The CVSS from NVD indicates HIGH impact with network attack vector and no user i...

CVE-2021-0943

CVE-2021-0943 affects Android, with the MMU_MapPages function showing an out-of-bounds write due to improper input validation. This could lead to local escalation of privilege without extra execution privileges, and exploitation requires no user interaction. Sources consistently describe the vuln...

CVE-2021-39729

The CVE-2021-39729 issue affects the TitanM chip in Android, caused by a missing bounds check that enables an out-of-bounds write. This can lead to local privilege escalation with System execution privileges required, and exploitation does not require user interaction. Documents consistently desc...

CVE-2022-20237

The CVE-2022-20237 entry affects Android kernel code, specifically the BuildDevIDResponse function in miscdatabuilder.cpp. A missing bounds check can cause an out-of-bounds write, which the provided documents state could enable remote code execution without extra privileges or user interaction. T...

CVE-2022-20435

CVE-2022-20435 is an Android vulnerability described as an unauthorized service in the system service that, due to missing permission checks, can lead to local elevation of privilege and potentially a system reboot. Connected OSV entries (ASB-A-242248367 and ASB-A-242248369) corroborate an unauth...

CVE-2020-0376

CVE-2020-0376 has concrete details in connected documents: it is an out-of-bounds read due to a missing bounds check affecting MediaTek components in Android, specifically MTK ISP within Android SoC. The root cause is a missing bounds check leading to a possible local information disclosure; expl...

CVE-2021-39814

CVE-2021-39814 affects Android kernel: in ppmp_validate_wsm of drm_fw.c there is an out-of-bounds write caused by an incorrect bounds check, enabling local privilege escalation with System execution privileges required and no user interaction. Documents indicate a local attack with high impact (C...

CVE-2024-34732

Google Android , which is based on the Linux kernel , is vulnerable to an elevation of privilege flaw. The root cause is a race condition (contention condition) in the RGXMMUCacheInvalidate function of rgxmem.c . An attacker can exploit this to execute arbitrary code and achieve local escalation ...

CVE-2021-0574

The vulnerability CVE-2021-0574 affects the asf extractor in Android (MediaTek components) where an out-of-bounds write occurs due to a missing bounds check. This can lead to local elevation of privilege with no user interaction required; exploitation details are not provided in the documents. Re...

CVE-2021-0699

Summary (CVE-2021-0699) An out-of-bounds write in HTBLogKM of TBD can lead to local kernel privilege escalation with no user interaction required. Connected sources indicate this vulnerability affects Imagination Technologies’ PowerVR-GPU components (PowerVR-GPU CVE-2021-0699) and is rated High s...

CVE-2021-0872

CVE-2021-0872 affects Imagination Technologies PowerVR kernel driver (PowerVR-GPU) via PVRSRVBridgeRGXKickVRDM. The issue is a missing size check that enables an integer overflow, leading to out-of-bounds heap access and local escalation of privilege with no extra privileges or user interaction r...

CVE-2022-20430

CVE-2022-20430 is mapped to UNISOC components, with the vulnerability labeled as High severity in Telephony. The root cause per provided documents is a missing authorization/permission check in a system service, enabling Local Privilege Elevation. The Android context is indicated, with references...

CVE-2023-3781

CVE-2023-3781 describes a use-after-free write from improper locking in a kernel component, enabling local elevation of privilege without user interaction. The threat is local access required (attack vector LOCAL) with a high impact on confidentiality, integrity, and availability as per CVSS. The...

CVE-2023-48398

CVE-2023-48398 affects the ProtocolNetAcBarringInfo::ProtocolNetAcBarringInfo() function in protocolnetadapter.cpp, where a missing bounds check can cause an out-of-bounds read. This can lead to remote information disclosure and requires baseband firmware compromise, with no user interaction need...

CVE-2024-23696

The CVE-2024-23696 issue is tied to the RGXCreateZSBufferKM function in rgxta3d.c, where a use-after-free leads to possible arbitrary code execution and local elevation of privilege in the kernel. Exploitation reportedly requires local access with no extra privileges and no user interaction. Conn...

CVE-2024-34729

CVE-2024-34729 is linked to PowerVR-GPU in the Android ecosystem. The connected sources describe a logic error that could enable arbitrary code execution, resulting in local privilege escalation in kernel-related contexts. Exploitation details are not provided in the documents, and a specific pat...

CVE-2017-11089

CVE-2017-11089: A buffer overread in nl80211_set_station occurs when a user-space app sends NL80211_ATTR_LOCAL_MESH_POWER_MODE with data smaller than 4 bytes. Affected: Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernel. Root cause and exact vendor-specific fixes a...

CVE-2020-0016

CVE-2020-0016 concerns Broadcom Nexus firmware where an insecure default password in the Broadcom middleware could permit local escalation of privilege in the kernel without user interaction. Affected context is tied to Android devices/SoCs using this firmware; exploitation is described as local,...

CVE-2021-0946

CVE-2021-0946 concerns a kernel information disclosure in Android via the PowerVR PVRSRVBridgePMRPDumpSymbolicAddr path. The vulnerable sequence allocates a heap buffer (puiMemspaceNameInt), fills it through PMR_PDumpSymbolicAddr, and copies the buffer to userspace. If PMR_PDumpSymbolicAddr fails...

CVE-2022-20158

CVE-2022-20158 affects the Android kernel in the backing-dev.c component (bdi_put and bdi_unregister). The issue is a use-after-free leading to memory corruption, with the documented impact of local privilege escalation to SYSTEM level. Exploitation is described as local (AV:L, UI:N) with no user...

CVE-2022-20168

Summary: CVE-2022-20168 is listed in the Pixel 2022-06 bulletin as a DoS issue affecting the Modem component in Android devices (Pixel). The underlying document set identifies the issue under the Pixel Security patches with the DoS impact in the Modem area. Affected context (as per provided sourc...

CVE-2022-20437

CVE-2022-20437 affects Android Messaging. The issue is a denial-of-service vulnerability caused by an unauthorized broadcast within Messaging, leading to Local DoS on affected devices. Affected platform: Google Android (Android OS family with Messaging component). Root cause described as a flaw i...

CVE-2021-39660

Technical details about CVE-2021-39660 are not provided in the supplied documents. The materials reference an Android kernel race condition with local privilege escalation but no specifics on affected product versions or fixes. Monitor for updates.

CVE-2021-39719

CVE-2021-39719 affects the Android kernel, specifically the lwis subsystem (lwis_top_register_io in lwis_device_top.c). The issue is described as a possible out-of-bounds write caused by an integer overflow, leading to local elevation of privilege with System execution privileges required. User i...

CVE-2021-39730

CVE-2021-39730 affects the Android kernel as described in multiple sources. The vulnerability is an out-of-bounds read caused by a missing bounds check, potentially allowing local information disclosure with system execution privileges. Exploitation requires local access; no user interaction is r...

CVE-2022-20387

CVE-2022-20387 is listed in multiple sources as affecting Android on Unisoc Android SoC components. A connected Prion entry explicitly labels it as a “Code injection” issue, while the NVD/NVD-derived summaries indicate Android SoC/Android as the affected context with high-severity implications in...

CVE-2022-20434

CVE-2022-20434 is a local Elevation of Privilege in Android related to a missing authorization check in a system service. The vulnerability is associated with UNISOC components listed in the Android 2022-10-01/10-05 patch cycles (as shown in the Android bulletin mappings), affecting Android Telep...

CVE-2022-20440

CVE-2022-20440 affects Android’s Messaging component, where an unauthorized broadcast could lead to a Local Denial of Service. The issue is documented across multiple feeds (NVD/RH/NCSC/PT-PCI/etc.) with no specific exploit details provided in these excerpts. The Android Security Bulletin outline...

CVE-2022-42520

CVE-2022-42520: Use-after-free in Android’s ServiceInterface::HandleRequest (serviceinterface.cpp) can lead to local escalation of privilege to system level. Affected component: Android kernel/service interface; exploitation described as LOCAL with HIGH privileges required and no user interaction...

CVE-2023-21054

CVE-2023-21054 affects the Android kernel, specifically the EUTRAN_LCS_ConvertLCS_MOLRReq path in LPP_CommonUtil.c. A logic error can cause an out-of-bounds write, which could lead to remote code execution with System-level privileges. No user interaction is required. Exploitation status and in-t...

CVE-2023-21058

CVE-2023-21058 concerns the Android kernel component lcsm_bcm_assist.c (function lcsm_SendRrAcquiAssist ). A missing bounds check can cause an out-of-bounds write, leading to remote code execution with no additional privileges and no user interaction required. The description in the connected OSV...

CVE-2023-21162

CVE-2023-21162 affects the PowerVR GPU driver (Imagination Technologies) via RGXUnbackingZSBuffer in rgxta3d.c. The issue is a use-after-free that could enable arbitrary code execution and local kernel privilege escalation without extra interaction. Public exploitation details aren’t provided in ...

CVE-2024-40670

Technical details for CVE-2024-40670 are not publicly available in the provided documents, as the affected product and version remain TBD . The documents indicate a possible use after free due to a race condition in Google Android , which could lead to local escalation of privilege . Monitor for ...

CVE-2024-40671

CVE-2024-40671 affects DevmemIntChangeSparse2 in devicemem_server.c, with a missing permission check that could enable arbitrary code execution and local privilege escalation without user interaction. Public entries across multiple feeds (NVD, Red Hat, Vuln enrichment, and OSV) consistently descr...

CVE-2020-0407

The CVE-2020-0407 entry concerns Android kernel/F2FS encryption where hardware that supports only 32-bit IVs leads to truncation to 32 bits for 64-bit IVs in certain implementations. This IV truncation can cause IV reuse, weakening disk encryption and potentially enabling local information disclo...

CVE-2021-1049

CVE-2021-1049 affects Android via Unisoc components (slogmodem) in the Android SoC stack. The vulnerability is classified as High severity in the NVD entry, with CVSS v3.1/3.0 impacting network-based access with likely elevation of privileges or data disclosure, per associated entries. The connec...

CVE-2021-39734

CVE-2021-39734 is an Elevation of Privilege in Google Android telephony logic related to RCS messaging. The issue is described as stemming from a missing permission check in OneToOneChatImpl.java that could allow sending an RCS message without required permissions, enabling local privilege escala...

CVE-2022-20438

CVE-2022-20438 affects the Android Messaging component. The issue is an unauthorized broadcast in Messaging that can cause a Local Denial of Service. According to the CVE entry, the vulnerability is exploitable with local access (attack vector: LOCAL), requires low privileges, and does not requir...

CVE-2022-42499

CVE-2022-42499 affects the Android modem component sms_MmConManagement.c, where a heap buffer overflow can cause an out-of-bounds write. This vulnerability could enable remote code execution with no privileges and no user interaction required. Publicly available details in the Red Hat, NVD, and C...

CVE-2024-34733

A vulnerability exists in the Devicemem Server (specifically in the DevmemXIntMapPages function of devicemem_server.c ) within the Linux kernel environment, which also powers Google Android . The root cause is an integer overflow that could allow an attacker to achieve arbitrary code execution an...

CVE-2022-20388

CVE-2022-20388 affects Android SoC Unisoc components (Android platform) with high severity (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The Unisoc Android entry indicates this is an Android SoC issue with no public exploit details provided in the connected docs. The CVE is listed under the 20...

CVE-2022-20586

CVE-2022-20586 describes an elevation of privilege in the Android kernel due to improper input validation in the function valid_out_of_special_sec_dram_addr within drm_access_control.c. The vulnerability could allow local escalation of privilege without any additional execution privileges, with a...

CVE-2017-13216

CVE-2017-13216 affects Android kernel ashmem: in ashmem_ioctl, an out-of-bounds write occurs due to insufficient locking when accessing asma. This can enable local privilege escalation and code execution within a privileged process, with no user interaction required. Public advisories describe th...

CVE-2020-0433

CVE-2020-0433 affects the Android/Linux kernel: use-after-free in blk_mq_queue_tag_busy_iter (blk-mq-tag.c) caused by improper locking, enabling local privilege escalation with no user interaction. Public details in the Initial document describe the flaw; connected Nessus advisories (Unity Linux/...

CVE-2021-0879

CVE-2021-0879 involves the PVRSRVBridgeRGXTDMSubmitTransfer path of the PowerVR kernel driver. A missing size check enables a potential integer overflow, leading to out-of-bounds heap access. This could allow local escalation of privilege without additional execution privileges and without user i...

CVE-2022-20389

CVE-2022-20389 is tied to Android SoC/Unisoc components. The connected documents specify affected areas as Android SoC and Unisoc Android components, with a high severity rating (CVE-2022-20389) and no publicly disclosed exploit details in the provided sources. There are no vendor/product version...