CVE-2017-1000377

CVE-2017-1000377 concerns a vulnerability in PAX Linux where the default stack guard page is too small and can be bypassed, allowing a bypass of stack protections. The core details indicate this affects PAX Linux kernel versions as of 19 June 2017, originally from GRSecurity and shipped by other ...

CVE-2017-8106

The CVE-2017-8106 issue affects the Linux kernel (arch/x86/kvm/vmx.c) in versions 3.12–3.15. The vulnerability arises from the handle_invept path, enabling privileged KVM guest OS users to trigger a NULL pointer dereference via a single-context INVEPT with a NULL EPT pointer, causing a denial of ...

CVE-2017-9984

The CVE-2017-9984 issue affects the Linux kernel’s snd_msnd_interrupt path (sound/isa/msnd/msnd_pinnacle.c) and is a local, double-fetch vulnerability that can allow over-boundary access to a message queue head pointer, potentially enabling DoS or other impact. The advisory notes vulnerable until...

CVE-2017-9986

The CVE-2017-9986 issue affects the Linux kernel’s sound/oss/msnd_pinnacle.c: the intr function is vulnerable to a double-fetch scenario when the message queue head pointer is read between two kernel reads, up to kernel versions through 4.11.7. This local condition allows a unprivileged user to c...

CVE-2017-0523

CVE-2017-0523 is an elevation-of-privilege vulnerability in the Qualcomm Wi‑Fi driver that could allow a local malicious app to execute arbitrary code in the kernel. The CVSS3 vector indicates LOCAL access, high complexity, no privileges required, but user interaction is required; root cause is e...

CVE-2017-0620

CVE-2017-0620 is a local elevation-of-privilege in the Qualcomm Secure Channel Manager driver on Android, allowing a malicious local app to run code in the kernel. Affected: Android devices with Kernel-3.10/3.18 (per the CVE entry). Impact per sources is High (CVSSv3: 7.0). Affected devices liste...

CVE-2017-5550

CVE-2017-5550 describes an off-by-one/error in the Linux kernel pipe_advance function (lib/iov_iter.c) that could allow local attackers to read from uninitialized kernel heap memory via a pipe, before the fixed 4.9.5 release. Connected advisories (EulerOS, Unity Linux) reference kernel versions b...

CVE-2016-8413

CVE-2016-8413 is an information disclosure vulnerability in the Qualcomm camera driver on Android. The issue affects Kernel-3.10 and Kernel-3.18 environments and could let a local malicious application access data outside its usual permission level after compromising a privileged process. Impact ...

CVE-2017-0563

CVE-2017-0563 is an elevation-of-privilege in the HTC touchscreen driver affecting the Android kernel (Kernel-3.10). A local malicious application could execute arbitrary code in the kernel context, potentially enabling a persistent device compromise that may require reflashing. The vulnerability...

CVE-2017-0569

CVE-2017-0569 is a local elevation-of-privilege flaw in the Broadcom Wi‑Fi driver (bcmdhd) used by Android. The root cause is a kernel‑level heap/buffer risk in handling a crafted WLC_E_PFN_SWC event: an attacker controlling the Wi‑Fi dongle can force a mismatch between total_count and pkt_count,...

CVE-2017-0404

CVE-2017-0404 is an elevation-of-privilege vulnerability in the Android kernel sound subsystem that could allow a local malicious application to execute arbitrary code in kernel context. Affected products/versions include Android devices using kernel 3.10 and 3.18. The issue requires compromising...

CVE-2017-0524

CVE-2017-0524 concerns an elevation-of-privilege in the Synaptics touchscreen driver within Android kernels, allowing a local malicious application to execute arbitrary kernel code. According to the linked sources, affected components are the Synaptics touchscreen driver in Android products with ...

CVE-2017-8067

The vulnerability CVE-2017-8067 affects the Linux kernel drivers/char/virtio_console.c in kernels 4.9.x and 4.10.x prior to 4.10.12, where improper interaction with CONFIG_VMAP_STACK allows a local user to cause a denial of service (system crash or memory corruption) or other impact by using more...

CVE-2017-0510

CVE-2017-0510 describes an elevation-of-privilege vulnerability in the Android kernel FIQ debugger that could allow a local malicious app to execute code in kernel context. Affected: Android on Kernel-3.10 (Nexus 9 cited). Impact: potential local permanent device compromise requiring OS reflashin...

CVE-2016-5856

Technical details for CVE-2016-5856 are not publicly available in the provided documents. Monitor for updates.

CVE-2016-6761

CVE-2016-6761 describes an elevation of privilege vulnerability in Qualcomm media codecs on Android. A local malicious app could execute arbitrary code within the context of a privileged process due to this flaw in the media codecs. Affected devices include Nexus 5X/6/6P, Nexus 9, Android One, Ne...

CVE-2016-8432

CVE-2016-8432 describes an elevation-of-privilege in the NVIDIA GPU driver on Android with kernel-3.18, enabling a local malicious app to run arbitrary code in kernel context. Affected product: Android devices using NVIDIA GPU drivers (Pixel C cited in Google's patch table). Impact is labeled Cri...

CVE-2017-8063

The CVE-2017-8063 issue affects Linux kernel 4.9.x and 4.10.x before 4.10.12, where the cxusb.c driver in drivers/media/usb/dvb-usb mishandles interaction with CONFIG_VMAP_STACK, allowing a local user to cause a denial of service (system crash) or other unspecified impact by leveraging more than ...

CVE-2017-9211

The CVE-2017-9211 flaw affects the Linux kernel component crypto_skcipher_init_tfm in crypto/skcipher.c up to version 4.11.2. It relies on setkey without a key-size check, allowing a local user to cause a denial of service via a NULL pointer dereference. The connected documents indicate a patch/c...

CVE-2017-0427

CVE-2017-0427 is an elevation-of-privilege vulnerability in the Android kernel file system. A local attacker could execute arbitrary code in the kernel context on devices running Kernel-3.10 or Kernel-3.18, with a potential for permanent device compromise. The CVE’s patch status is not publicly a...

CVE-2017-0440

CVE-2017-0440 describes an elevation-of-privilege flaw in the Qualcomm Wi‑Fi driver for Android kernels 3.10 and 3.18. A local malicious app could exploit it to execute code in the kernel context, after compromising a privileged process. The vulnerability is classified as High severity in the pub...

CVE-2017-0572

The CVE-2017-0572 entry concerns Broadcom Wi‑Fi driver (bcmdhd) used in Android. The connected analysis provides concrete technical details: in the function dhd_pno_process_anqpo_result, a buffer is allocated as kmalloc(mem_needed,...), but a subsequent memcpy uses bi->SSID_len to copy the SSI...

CVE-2017-0429

CVE-2017-0429 is an elevation-of-privilege vulnerability in the NVIDIA kernel driver’s i2c-hid component, enabling a local attacker to write arbitrary values to kernel memory and potentially execute code with kernel privileges. Public descriptions tie the issue to the NVIDIA kernel driver on Andr...

CVE-2017-7979

CVE-2017-7979 affects the Linux kernel 4.11.x via the packet action API (net/sched/act_api.c). The vulnerability arises from mishandling the tb nlattr array in the cookie feature, enabling a local attacker to trigger denial of service through uninitialized memory access and a refcount underflow, ...

CVE-2016-6776

CVE-2016-6776 is an elevation-of-privilege vulnerability in the NVIDIA Tegra kernel driver (NVHOST) where referencing memory after it has been freed may allow a local attacker to escalate to kernel code execution. The issue is documented across NVIDIA Bulletins for Jetson TK1/K1 and Tegra-line de...

CVE-2017-0439

CVE-2017-0439 describes a local privilege-escalation vulnerability in the Qualcomm Wi‑Fi driver for Android, affecting Kernel-3.10 and Kernel-3.18. The issue could allow a local malicious app to execute arbitrary code in the kernel context after compromising a privileged process. The Android Prod...

CVE-2016-10153

The CVE-2016-10153 issue affects the Linux kernel 4.9.x before 4.9.6, where the crypto scatterlist API interacts incorrectly with CONFIG_VMAP_STACK, enabling local attackers to cause a denial of service (system crash or memory corruption) or potentially other impacts due to reliance on earlier ne...

CVE-2016-6789

CVE-2016-6789 is an elevation-of-privilege in the NVIDIA libomx library (LIBNVOMX.SO) that could allow a local attacker to execute arbitrary code with privileged process rights. Affected environment is Android (kernel 3.18) using NVIDIA components. The vulnerability is scored as CVSS v3.0 base 9....

CVE-2016-8424

CVE-2016-8424 is an elevation-of-privilege in the NVIDIA Tegra GPU driver (NVMAP) that can let a local, unprivileged process execute code in kernel context by referencing memory after it has been freed (use-after-free). Affected: Android devices using the NVIDIA Tegra kernel driver (Kernel-3.10)....

CVE-2017-0446

CVE-2017-0446: Elevation of privilege in the HTC touchscreen driver on Android kernel 3.18, allowing a local attacker to execute arbitrary code in kernel context. Exploitation requires compromising a privileged process and local access. Publicly available patch/fix details are not provided in the...

CVE-2017-0460

CVE-2017-0460 describes a local elevation-of-privilege in the Qualcomm networking driver on Android, allowing a malicious local app to execute code in the kernel. Affected are Android kernels 3.10 and 3.18; the exploit requires compromising a privileged process and does not appear to be remotely ...

CVE-2017-0527

CVE-2017-0527 describes an elevation-of-privilege vulnerability in the HTC Sensor Hub Driver on Android, enabling a local malicious app to execute arbitrary code in kernel context. Affected products/versions: Android on kernel 3.10 and 3.18. Root cause is operating in the context of the kernel af...

CVE-2017-0579

CVE-2017-0579 is a local elevation-of-privilege issue in the Qualcomm Video driver on Android, enabling a local malicious app to execute arbitrary kernel code. Affected: Android kernel 3.10 and 3.18; root cause: Qualcomm video driver elevation of privilege. Exploitation status is not detailed in ...

CVE-2017-8062

CVE-2017-8062 concerns the Linux kernel vulnerability in drivers/media/usb/dvb-usb/dw2102.c. The issue affects kernel series 4.9.x and 4.10.x prior to 4.10.4, where interaction with CONFIG_VMAP_STACK can allow a local user to trigger a denial of service (system crash or memory corruption) or othe...

CVE-2017-0332

CVE-2017-0332 affects the NVIDIA crypto driver in Android kernels (NVIDIA Tegra). The vulnerability arises from a heap-allocated buffer overwrite in the cryptodev path, which could allow a local attacker to execute arbitrary code in kernel context (privilege escalation). Android’s public bulletin...

CVE-2017-0403

CVE-2017-0403 is an elevation-of-privilege vulnerability in the Android kernel performance subsystem. The issue could allow a local malicious application to execute arbitrary code within the kernel context, requiring initial access via a privileged process. Affected software is Android’s kernel w...

CVE-2017-0433

CVE-2017-0433 is an elevation-of-privilege flaw in the Synaptics touchscreen driver for Android, tied to the Kernel-3.10 platform. The vulnerability could allow a local, privileged attacker to execute arbitrary code within the touchscreen chipset context. Several connected sources (including NVD ...

CVE-2017-0531

CVE-2017-0531 is an information-disclosure vulnerability in the Qualcomm Wi‑Fi driver for Android, allowing a local malicious application to access data outside its permission levels after compromising a privileged process. Affected components/versions are Android kernel build lines (Kernel-3.10 ...

CVE-2017-0571

CVE-2017-0571 stems from Broadcom’s Wi‑Fi driver (bcmdhd) on Android. A WLFC TLV parity parsing path fails to validate length fields, allowing an attacker controlling the dongle to craft a TLV with a large length (e.g., 255) which overflows a stack buffer, enabling local code execution in the ker...

CVE-2017-0648

CVE-2017-0648 is a local elevation-of-privilege in the Android kernel FIQ debugger. The issue arises from the FIQ debugger and SysRq access enabling arbitrary kernel code execution when exploited by a local attacker via a compromised device. Technical details in the connected sources show the roo...

CVE-2017-5547

The CVE-2017-5547 issue affects Linux kernel 4.9.x prior to 4.9.6, specifically the drivers/hid/hid-corsair.c path. The root cause is incorrect interaction with CONFIG_VMAP_STACK, enabling a local attacker to trigger a denial of service (system crash) or memory corruption by abusing more than one...

CVE-2016-8430

CVE-2016-8430 affects the NVIDIA Tegra kernel driver (NVHOST) on Android, where a mismanaged memory reference (user-after-free) can let a local attacker cause a denial of service or escalate to kernel code execution. The issue is described as elevation of privilege with potential for local persis...

CVE-2017-0325

CVE-2017-0325 affects the NVIDIA kernel driver’s i2c-hid component on Android. The issue allows an attacker to escalate privileges and execute arbitrary code in the kernel context by writing arbitrary data to an arbitrary location within i2c-hid. The vulnerability is local and requires interactio...

CVE-2017-0430

CVE-2017-0430 affects Android, involving an elevation of privilege in the Broadcom Wi‑Fi driver that could allow a local malicious application to execute arbitrary code in the kernel context. Affected components are Android kernels 3.10 and 3.18 with Broadcom Wi‑Fi driver involvement; the issue i...

CVE-2017-0455

CVE-2017-0455 is an information-disclosure vulnerability in the Qualcomm bootloader that could allow a local malicious app to execute arbitrary code within the bootloader context on affected Android devices (Kernel 3.18). CNVD/OSV entries tie it to Google Pixel devices (Pixel/Pixel XL); Nessus no...

CVE-2017-0456

CVE-2017-0456 describes an elevation-of-privilege flaw in the Qualcomm IPA driver that allows a local attacker to run code in the kernel context on Android. Affected components/versions include Android kernel 3.10 and 3.18 with the issue stemming from the IPA driver in Qualcomm silicon. The vulne...

CVE-2017-0584

CVE-2017-0584 is an information-disclosure issue in the Qualcomm Wi‑Fi driver affecting Android. The vulnerability could let a local malicious application access data outside its permissions, requiring compromise of a privileged process. The Initial document cites kernel versions 3.10 and 3.18 an...

CVE-2017-8068

CVE-2017-8068 affects the Linux kernel 4.9.x before 4.9.11, where drivers/net/usb/pegasus.c interacts incorrectly with CONFIG_VMAP_STACK. This enables a local attacker to trigger a denial of service or memory corruption by exploiting use of more than one virtual page for a DMA scatterlist. The is...

CVE-2016-8417

CVE-2016-8417 describes an elevation-of-privilege vulnerability in the Qualcomm camera driver on Android. The issue could let a local malicious application execute arbitrary code in the kernel context by exploiting the Qualcomm camera driver (in Android kernel versions 3.10 and 3.18). The vulnera...

CVE-2017-0436

Summary of CVE-2017-0436 (Qualcomm sound driver privilege escalation) : The vulnerability affects Android, specifically the Qualcomm sound driver within kernel contexts (kernel versions 3.10 and 3.18). It enables a local, malicious application to elevate privileges and execute arbitrary code in t...