Android releases from CAF using the Linux kernel vulnerabilities

All Android releases from CAF using the Linux kernel have a buffer overflow vulnerability in a WLAN function due to an incorrect message length.

All Android releases from CAF using the Linux kernel have a buffer overflow vulnerability while loading a firmware image.

All Android releases from CAF using the Linux kernel may be vulnerable to out of bounds access in a camera function.

All Android releases from CAF using the Linux kernel may have an issue with a data pointer that can be used after it has been freed when SLIMbus is turned off by Bluetooth.

All Android releases from CAF using the Linux kernel have an issue with improper validation of an array index in an ALSA routine, potentially leading to kernel stack corruption.

All Android releases from CAF using the Linux kernel have an integer underflow vulnerability while processing the boot image.

All Android releases from CAF using the Linux kernel may be vulnerable to buffer overreads if a particular string is not NULL terminated.

All Android releases from CAF using the Linux kernel have a buffer overflow vulnerability in a syscall handler.

All Android releases from CAF using the Linux kernel have a problem with excessive privileges for third-party TEEs (Trusted Execution Environments). This may lead to unauthorized access to system resources.

All Android releases from CAF using the Linux kernel contain a buffer overflow vulnerability caused by an integer underflow in a syscall handler.

All Android releases from CAF using the Linux kernel may allow HLOS to overwrite secure memory or read contents of the keystore.

All Android releases from CAF using the Linux kernel have an issue related to RPMB processing.

All Android releases from CAF using the Linux kernel have an issue with the QTEE system call that fails to validate a pointer.

All Android releases from CAF using the Linux kernel may have an issue with the Hypervisor API that could be misused to bypass authentication.

All Android releases from CAF using the Linux kernel contain a buffer overflow vulnerability in a cryptographic routine.

All Android releases from CAF using the Linux kernel have Time-of-check Time-of-use (TOCTOU) race condition issues in several TZ APIs.

All Android releases from CAF using the Linux kernel have an untrusted pointer dereference vulnerability in the unlocking of memory.

All Android releases from CAF using the Linux kernel have a vulnerability in the parsing of an SCM call.

All Android releases from CAF using the Linux kernel have an integer overflow vulnerability in debug functionality.

All Android releases from CAF using the Linux kernel have a vulnerability in the parsing of a DRM provisioning command.

All Android releases from CAF using the Linux kernel have a vulnerability in eMMC write protection that can be used to bypass power-on write protection.

In Android releases from CAF using the Linux kernel, a Signed to Unsigned Conversion Error may occur.

All Android releases from CAF using the Linux kernel may pass shared content protection memory as the secure camera memory buffer to a trusted application, leading to a misinterpretation of this memory as secure.

All Android releases from CAF using the Linux kernel may have an issue with PKCS#1 v1.5 signature verification as they may not check padding.

Due to missing input validation in all Android releases from CAF using the Linux kernel, HLOS can write to fuses for which it should not have access.

All Android releases from CAF using the Linux kernel may be vulnerable to a buffer overflow that can occur if an OEM customizes the app region size due to a hard-coded value.

In function msm_pcm_playback_close() in all Android releases from CAF using the Linux kernel, prtd is assigned substream->runtime->private_data. Later, prtd is freed but not sanitized or set to NULL, resulting in a dangling pointer.

All Android releases from CAF using the Linux kernel are vulnerable to an issue related to processing a voice SVC request. When a nonstandard payload size is specified that exceeds its declared size, an out of bounds memory copy occurs.

In core_info_read and inst_info_read in all Android releases from CAF, variables 'dbg_buf', 'dbg_buf->curr', and 'dbg_buf->filled_size' can be modified simultaneously by different threads, leading to a lack of protection with mutexes or locks. Buffer overflow is possible on race conditions.