Google Android vulnerabilities

CVE-2024-43088 [HIGH] CWE-862 CVE-2024-43088: In multiple functions in AppInfoBase.java, there is a possible way to manipulate app permission sett In multiple functions in AppInfoBase.java, there is a possible way to manipulate app permission settings belonging to another user on the device due to a missing permission check. This could lead to local escalation of privilege across user boundaries with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-31319 [HIGH] CWE-610 CVE-2024-31319: In updateNotificationChannelFromPrivilegedListener of NotificationManagerService.java, there is a po In updateNotificationChannelFromPrivilegedListener of NotificationManagerService.java, there is a possible cross-user data leak due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2022-20131 [HIGH] CWE-125 CVE-2022-20131: In nci_proc_rf_management_ntf of nci_hrcv.cc, there is a possible out of bounds read due to a missin In nci_proc_rf_management_ntf of nci_hrcv.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-22185666

CVE-2022-20123 [HIGH] CWE-125 CVE-2022-20123: In phNciNfc_RecvMfResp of phNxpExtns_MifareStd.cpp, there is a possible out of bounds read due to a In phNciNfc_RecvMfResp of phNxpExtns_MifareStd.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-221

CVE-2018-9471 [HIGH] CWE-843 CVE-2018-9471: In the deserialization constructor of NanoAppFilter.java, there is a possible loss of data due to ty In the deserialization constructor of NanoAppFilter.java, there is a possible loss of data due to type confusion. This could lead to local escalation of privilege in the system server with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-32900 [HIGH] CWE-416 CVE-2024-32900: In lwis_fence_signal of lwis_debug.c, there is a possible Use after Free due to improper locking. Th In lwis_fence_signal of lwis_debug.c, there is a possible Use after Free due to improper locking. This could lead to local escalation of privilege from hal_camera_default SELinux label with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-0033 [HIGH] CWE-787 CVE-2024-0033: In multiple functions of ashmem-dev.cpp, there is a possible missing seal due to a heap buffer overf In multiple functions of ashmem-dev.cpp, there is a possible missing seal due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-35685 [HIGH] CWE-416 CVE-2023-35685: In DevmemIntMapPages of devicemem_server.c, there is a possible physical page uaf due to a logic err In DevmemIntMapPages of devicemem_server.c, there is a possible physical page uaf due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21342 [HIGH] CVE-2023-21342: In RemoteSpeechRecognitionService of RemoteSpeechRecognitionService.java, there is a possible way to In RemoteSpeechRecognitionService of RemoteSpeechRecognitionService.java, there is a possible way to launch an activity from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-34741 [HIGH] CWE-269 CVE-2024-34741: In setForceHideNonSystemOverlayWindowIfNeeded of WindowState.java, there is a possible way for messa In setForceHideNonSystemOverlayWindowIfNeeded of WindowState.java, there is a possible way for message content to be visible on the screensaver while lock screen visibility settings are restricted by the user due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interact

CVE-2022-23428 [HIGH] CWE-120 CVE-2022-23428: An improper boundary check in eden_runtime hal service prior to SMR Feb-2022 Release 1 allows arbitr An improper boundary check in eden_runtime hal service prior to SMR Feb-2022 Release 1 allows arbitrary memory write and code execution.

CVE-2024-0029 [HIGH] CWE-693 CVE-2024-0029: In multiple files, there is a possible way to capture the device screen when disallowed by device po In multiple files, there is a possible way to capture the device screen when disallowed by device policy due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-20904 [HIGH] CVE-2023-20904: In getTrampolineIntent of SettingsActivity.java, there is a possible launch of arbitrary activity du In getTrampolineIntent of SettingsActivity.java, there is a possible launch of arbitrary activity due to an Intent mismatch in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12L Android-13Android ID: A-246300272

CVE-2024-31326 [HIGH] CWE-783 CVE-2024-31326: In multiple locations, there is a possible way in which policy migration code will never be executed In multiple locations, there is a possible way in which policy migration code will never be executed due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-40094 [HIGH] CWE-862 CVE-2023-40094: In keyguardGoingAway of ActivityTaskManagerService.java, there is a possible lock screen bypass due In keyguardGoingAway of ActivityTaskManagerService.java, there is a possible lock screen bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-40080 [HIGH] CWE-787 CVE-2023-40080: In multiple functions of btm_ble_gap.cc, there is a possible out of bounds write due to a logic erro In multiple functions of btm_ble_gap.cc, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2022-20040 [HIGH] CWE-787 CVE-2022-20040: In power_hal_manager_service, there is a possible permission bypass due to a stack-based buffer over In power_hal_manager_service, there is a possible permission bypass due to a stack-based buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06219150; Issue ID: ALPS06219150.

CVE-2023-40079 [HIGH] CVE-2023-40079: In injectSendIntentSender of ShortcutService.java, there is a possible background activity launch du In injectSendIntentSender of ShortcutService.java, there is a possible background activity launch due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-40097 [HIGH] CWE-20 CVE-2023-40097: In hasPermissionForActivity of PackageManagerHelper.java, there is a possible URI grant due to impro In hasPermissionForActivity of PackageManagerHelper.java, there is a possible URI grant due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2023-40091 [HIGH] CWE-787 CVE-2023-40091: In onTransact of IncidentService.cpp, there is a possible out of bounds write due to memory corrupti In onTransact of IncidentService.cpp, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.