Google Android vulnerabilities

CVE-2024-0014 [HIGH] CWE-693 CVE-2024-0014: In startInstall of UpdateFetcher.java, there is a possible way to trigger a malicious config update In startInstall of UpdateFetcher.java, there is a possible way to trigger a malicious config update due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-20904 [HIGH] CVE-2023-20904: In getTrampolineIntent of SettingsActivity.java, there is a possible launch of arbitrary activity du In getTrampolineIntent of SettingsActivity.java, there is a possible launch of arbitrary activity due to an Intent mismatch in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12L Android-13Android ID: A-246300272

CVE-2023-40094 [HIGH] CWE-862 CVE-2023-40094: In keyguardGoingAway of ActivityTaskManagerService.java, there is a possible lock screen bypass due In keyguardGoingAway of ActivityTaskManagerService.java, there is a possible lock screen bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-40080 [HIGH] CWE-787 CVE-2023-40080: In multiple functions of btm_ble_gap.cc, there is a possible out of bounds write due to a logic erro In multiple functions of btm_ble_gap.cc, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2022-20040 [HIGH] CWE-787 CVE-2022-20040: In power_hal_manager_service, there is a possible permission bypass due to a stack-based buffer over In power_hal_manager_service, there is a possible permission bypass due to a stack-based buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06219150; Issue ID: ALPS06219150.

CVE-2023-40079 [HIGH] CVE-2023-40079: In injectSendIntentSender of ShortcutService.java, there is a possible background activity launch du In injectSendIntentSender of ShortcutService.java, there is a possible background activity launch due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-0048 [HIGH] CWE-230 CVE-2024-0048: In Session of AccountManagerService.java, there is a possible method to retain foreground service pr In Session of AccountManagerService.java, there is a possible method to retain foreground service privileges due to incorrect handling of null responses. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-40097 [HIGH] CWE-20 CVE-2023-40097: In hasPermissionForActivity of PackageManagerHelper.java, there is a possible URI grant due to impro In hasPermissionForActivity of PackageManagerHelper.java, there is a possible URI grant due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2023-40095 [HIGH] CVE-2023-40095: In createDontSendToRestrictedAppsBundle of PendingIntentUtils.java, there is a possible background a In createDontSendToRestrictedAppsBundle of PendingIntentUtils.java, there is a possible background activity launch due to a missing check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-40091 [HIGH] CWE-787 CVE-2023-40091: In onTransact of IncidentService.cpp, there is a possible out of bounds write due to memory corrupti In onTransact of IncidentService.cpp, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-45773 [HIGH] CWE-787 CVE-2023-45773: In multiple functions of btm_ble_gap.cc, there is a possible out of bounds write due to a missing bo In multiple functions of btm_ble_gap.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-45774 [HIGH] CVE-2023-45774: In fixUpIncomingShortcutInfo of ShortcutService.java, there is a possible way to view another user's In fixUpIncomingShortcutInfo of ShortcutService.java, there is a possible way to view another user's image due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21113 [HIGH] CWE-269 CVE-2023-21113: In multiple locations, there is a possible permission bypass due to a confused deputy. This could le In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21114 [HIGH] CWE-269 CVE-2023-21114: In multiple locations, there is a possible permission bypass due to a confused deputy. This could le In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2021-1035 [HIGH] CWE-610 CVE-2021-1035: In setLaunchIntent of BluetoothDevicePickerPreferenceController.java, there is a possible way to inv In setLaunchIntent of BluetoothDevicePickerPreferenceController.java, there is a possible way to invoke an arbitrary broadcast receiver due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-12A

CVE-2024-0035 [HIGH] CWE-476 CVE-2024-0035: In onNullBinding of TileLifecycleManager.java, there is a possible way to launch an activity from th In onNullBinding of TileLifecycleManager.java, there is a possible way to launch an activity from the background due to a missing null check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-48409 [HIGH] CWE-190 CVE-2023-48409: In gpu_pixel_handle_buffer_liveness_update_ioctl of private/google-modules/gpu/mali_kbase/mali_kbase In gpu_pixel_handle_buffer_liveness_update_ioctl of private/google-modules/gpu/mali_kbase/mali_kbase_core_linux.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-40089 [HIGH] CWE-862 CVE-2023-40089: In getCredentialManagerPolicy of DevicePolicyManagerService.java, there is a possible method for use In getCredentialManagerPolicy of DevicePolicyManagerService.java, there is a possible method for users to select credential managers without permission due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-34723 [HIGH] CWE-783 CVE-2024-34723: In onTransact of ParcelableListBinder.java , there is a possible way to steal mAllowlistToken to lau In onTransact of ParcelableListBinder.java , there is a possible way to steal mAllowlistToken to launch an app from background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-31339 [HIGH] CWE-416 CVE-2024-31339: In multiple functions of StatsService.cpp, there is a possible memory corruption due to a use after In multiple functions of StatsService.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.