Remote code execution

Remote code execution

there is a possible out of bounds write due to buffer overflow

In ProtocolMiscLceIndAdapter::GetConfLevel() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check

In ProtocolEmbmsGlobalCellIdAdapter::Init() of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check

In TBD of TBD, there is a possible stack buffer overflow due to a missing bounds check

In eatt_l2cap_reconfig_completed of eatt_impl.h, there is a possible out of bounds write due to an integer overflow

In multiple locations, there is a possible code execution due to type confusion

In isServerCertChainValid of InsecureEapNetworkHandler.java, there is a possible way to trust an imposter server due to a logic error in the code

In processMessageImpl of ClientModeImpl.java, there is a possible credential disclosure in the TOFU flow due to a logic error in the code

In gatt_end_operation of gatt_utils.cc, there is a possible out of bounds write due to a missing bounds check

In getPendingIntentLaunchFlags of ActivityOptions.java, there is a possible elevation of privilege due to a confused deputy with no additional execution privileges needed

In cd_CodeMsg of cd_codec.c, there is a possible out of bounds write due to a heap buffer overflow

In btm_ble_periodic_adv_sync_lost of btm_ble_gap.cc, there is a possible remote code execution due to a buffer overflow

In _PMRCreate of the PowerVR kernel driver, a missing bounds check means it is possible to overwrite heap memory via PhysmemNewRamBackedPMR

In PVRSRVBridgeSyncPrimOpCreate of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap access

Product: AndroidVersions: Android SoCAndroid ID: A-273754094

In OnWakelockReleased of attribution_processor.cc, there is a use after free that could lead to remote code execution with no additional execution privileges needed

In lcsm_SendRrAcquiAssist of lcsm_bcm_assist.c, there is a possible out of bounds write due to a missing bounds check

In ProfSixDecomTcpSACKoption of RohcPacketCommon, there is a possible out of bounds write due to a missing bounds check

In SDP_AddAttribute of sdp_db.cc, there is a possible out of bounds write due to an incorrect bounds check

In gatt_process_prep_write_rsp of gatt_cl.cc, there is a possible out of bounds write due to a missing bounds check

In sms_SendMmCpErrMsg of sms_MmConManagement.c, there is a possible out of bounds write due to a heap buffer overflow

In Pixel cellular firmware, there is a possible out of bounds write due to a missing bounds check

In parseTrackFragmentRun() of MPEG4Extractor.cpp, there is a possible out of bounds read due to an integer overflow

In onStart of BluetoothSwitchPreferenceController.java, there is a possible permission bypass due to a confused deputy

Product: AndroidVersions: Android kernelAndroid ID: A-235292841References: N/A

In toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check

In toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check

Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238257000

Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238257002

Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238257004

Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238227323

Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238227324

Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238227328

a function called 'nla_parse', do not check the len of para, it will check nla_type (which can be controlled by userspace) with 'maxtype' (in this case, it is GSCAN_MAX), then it…

The path in this case is a little bit convoluted

In BT firmware, there is a possible out of bounds write due to a missing bounds check

The PowerVR GPU driver allows unprivileged apps to allocated pinned memory, unpin it (which makes it available to be freed), and continue using the page in GPU calls

The PowerVR GPU driver allows unprivileged apps to allocated pinned memory, unpin it (which makes it available to be freed), and continue using the page in GPU calls

Product: AndroidVersions: Android kernelAndroid ID: A-216363416References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-207975764References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-218701042References: N/A

In cd_CodeMsg of cd_codec.c, there is a possible out of bounds write due to a missing bounds check

Product: AndroidVersions: Android kernelAndroid ID: A-211727306References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-188935887References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-234657153References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-229632566References: N/A

In BuildDevIDResponse of miscdatabuilder.cpp, there is a possible out of bounds write due to a missing bounds check

In btif_dm_auth_cmpl_evt of btif_dm.cc, there is a possible vulnerability in Cross-Transport Key Derivation due to Weakness in Bluetooth Standard