CVE Vulnerability Catalog

W metodzie isSystemUid w pliku AccountManagerService.java istnieje możliwość, że aplikacja uzyska dostęp do uprzywilejowanych interfejsów API z powodu zjawiska zwanego 'confused deputy'. Może to prowadzić do lokalnej eskalacji uprawnień bez potrzeby dodatkowych uprawnień wykonawczych.

W wielu miejscach istnieje możliwość odczytu plików należących do innych aplikacji z powodu podatności na wstrzykiwanie SQL. Może to prowadzić do lokalnego podniesienia uprawnień bez potrzeby dodatkowych uprawnień wykonawczych.

In onCreate of FaceSettings.java, there is a possible way to remove biometric unlock across user profiles due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple locations, there is a possible way to use apps linked from a context menu of a lockscreen app due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In setRingtoneUri of VoicemailNotificationSettingsUtil.java, there is a possible cross user data leak due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In the onStart method of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an unsafe PendingIntent, which could lead to local escalation of privilege. User interaction is needed.

In showDismissibleKeyguard of KeyguardService.java, there is a possible way to bypass app pinning due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In onHandleForceStop of VoiceInteractionManagerService.java, there is a bug that could cause the system to incorrectly revert to the default assistant application when a user-selected assistant is forcibly stopped due to a logic error in the code. This could lead to local escalation of privilege where the default assistant app is automatically granted ROLE_ASSISTANT with no additional execution privileges needed. User interaction is not needed for exploitation.

In validateIpConfiguration of WifiConfigurationUtil.java, there is a possible way to trigger a permanent DoS due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In the Linux kernel's io_uring/net subsystem, a vulnerability allows ring-provided buffers to be pinned across retries, leading to potential use of invalid pointers or data corruption when buffer groups are shared.

In the Linux kernel, a vulnerability in the CIFS module can cause a slab out-of-bounds read when mounting a share to a ksmbd server. The issue is due to a missing check in the parse_server_interfaces() function.

A vulnerability in the Linux kernel's netlink subsystem causes infinite retry looping in netlink_unicast(). The issue stems from an incorrect check of socket read memory constraints, leading to CPU stalls (RCU stall) and system unresponsiveness.

In the Linux kernel, the asix_devices driver for ASIX AX88772 USB Ethernet chips lacked a phy_mask setting for the MDIO bus. This caused up to 32 dummy PHY devices to be created, with only one binding to the network driver. During system suspend/resume, a NULL pointer dereference occurred in phy_state_machine(), leading to a crash.

In the Linux kernel, the NFS server (nfsd) function nfsd4_setclientid_confirm() does not check the return value of get_client_locked(). A race with an expiring client can lead to use-after-free (UAF).

In the habanalabs driver in the Linux kernel, a use-after-free (UAF) vulnerability was found in the export_dmabuf() function. After inserting a file reference into the descriptor table, another thread could close the file, and then the function continued to access objects that may have already been destroyed.

A reference count leak in ctnetlink_dump_table() in the Linux kernel's netfilter subsystem occurs when ct == last, causing a double increment that prevents conntrack object release. This blocks netns dismantle or conntrack module removal, leading to potential denial of service.

A vulnerability in the Linux kernel's SCTP stack involves unsafe access to shared fraglist buffers in cloned GSO packets. A cloned head skb shares fragments with the original, leading to uninitialized memory reads. The fix linearizes cloned GSO packets in sctp_rcv().

In the Linux kernel's KCM module, a race condition was found in kcm_unattach(). Missing check of the kcm->tx_stopped flag before calling queue_work() can re-queue tx_work after socket release, leading to use-after-free.

In the HFS filesystem in the Linux kernel, a vulnerability allows slab-out-of-bounds read in hfs_bnode_read() due to missing validation of offset and length, leading to access beyond allocated memory.