Google Android vulnerabilities

CVE-2021-1000 [HIGH] CWE-276 CVE-2021-1000: In createBluetoothDeviceSlice of ConnectedDevicesSliceProvider.java, there is a possible permission In createBluetoothDeviceSlice of ConnectedDevicesSliceProvider.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-185190688

CVE-2022-20002 [HIGH] CWE-862 CVE-2022-20002: In incfs, there is a possible way of mounting on arbitrary paths due to a missing permission check. In incfs, there is a possible way of mounting on arbitrary paths due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-198657657

CVE-2023-44122 [HIGH] CWE-927 CVE-2023-44122: The vulnerability is to theft of arbitrary files with system privilege in the LockScreenSettings ("c The vulnerability is to theft of arbitrary files with system privilege in the LockScreenSettings ("com.lge.lockscreensettings") app in the "com/lge/lockscreensettings/dynamicwallpaper/MyCategoryGuideActivity.java" file. The main problem is that the app launches implicit intents that can be intercepted by third-party apps installed on the same device.

CVE-2022-20084 [HIGH] CWE-862 CVE-2022-20084: In telephony, there is a possible way to disable receiving emergency broadcasts due to a missing per In telephony, there is a possible way to disable receiving emergency broadcasts due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06498874; Issue ID: ALPS06498874.

CVE-2022-20093 [HIGH] CWE-862 CVE-2022-20093: In telephony, there is a possible way to disable receiving SMS messages due to a missing permission In telephony, there is a possible way to disable receiving SMS messages due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06498868; Issue ID: ALPS06498868.

CVE-2023-35670 [HIGH] CWE-22 CVE-2023-35670: In computeValuesFromData of FileUtils.java, there is a possible way to insert files to other apps' e In computeValuesFromData of FileUtils.java, there is a possible way to insert files to other apps' external private directories due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21183 [HIGH] CVE-2023-21183: In ForegroundUtils of ForegroundUtils.java, there is a possible way to read NFC tag data while the a In ForegroundUtils of ForegroundUtils.java, there is a possible way to read NFC tag data while the app is still in the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-23

CVE-2023-21093 [HIGH] CWE-22 CVE-2023-21093: In extractRelativePath of FileUtils.java, there is a possible way to access files in a directory bel In extractRelativePath of FileUtils.java, there is a possible way to access files in a directory belonging to other applications due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 A

CVE-2023-21024 [HIGH] CWE-693 CVE-2023-21024: In maybeFinish of FallbackHome.java, there is a possible delay of lockdown screen due to logic error In maybeFinish of FallbackHome.java, there is a possible delay of lockdown screen due to logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-246543238

CVE-2022-39119 [HIGH] CWE-862 CVE-2022-39119: In network service, there is a missing permission check. This could lead to local escalation of priv In network service, there is a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed

CVE-2022-20281 [HIGH] CWE-862 CVE-2022-20281: In Core, there is a possible way to start an activity from the background due to a missing permissio In Core, there is a possible way to start an activity from the background due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-204083967

CVE-2023-21088 [HIGH] CVE-2023-21088: In deliverOnFlushComplete of LocationProviderManager.java, there is a possible way to bypass backgro In deliverOnFlushComplete of LocationProviderManager.java, there is a possible way to bypass background activity launch restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L

CVE-2022-21777 [HIGH] CWE-862 CVE-2022-21777: In Autoboot, there is a possible permission bypass due to a missing permission check. This could lea In Autoboot, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06713894; Issue ID: ALPS06713894.

CVE-2023-20906 [HIGH] CVE-2023-20906: In onPackageAddedInternal of PermissionManagerService.java, there is a possible way to silently gran In onPackageAddedInternal of PermissionManagerService.java, there is a possible way to silently grant a permission after a Target SDK update due to a permissions bypass. This could lead to local escalation of privilege after updating an app to a higher Target SDK with no additional execution privileges needed. User interaction is not needed for exploitation.P

CVE-2023-20947 [HIGH] CVE-2023-20947: In getGroupState of GrantPermissionsViewModel.kt, there is a possible way to keep a one-time permiss In getGroupState of GrantPermissionsViewModel.kt, there is a possible way to keep a one-time permission granted due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-23

CVE-2022-32635 [HIGH] CWE-787 CVE-2022-32635: In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to lo In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07573237; Issue ID: ALPS07573237.

CVE-2023-42689 [HIGH] CWE-862 CVE-2023-42689: In wifi service, there is a possible missing permission check. This could lead to local escalation o In wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed

CVE-2023-42681 [HIGH] CWE-862 CVE-2023-42681: In ion service, there is a possible missing permission check. This could lead to local escalation of In ion service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed

CVE-2023-42691 [HIGH] CWE-862 CVE-2023-42691: In wifi service, there is a possible missing permission check. This could lead to local escalation o In wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed

CVE-2023-42686 [HIGH] CWE-862 CVE-2023-42686: In wifi service, there is a possible missing permission check. This could lead to local escalation o In wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed