In OnWakelockReleased of attribution_processor.cc, there is a use after free that could lead to remote code execution with no additional execution privileges needed

In ProfSixDecomTcpSACKoption of RohcPacketCommon, there is a possible out of bounds write due to a missing bounds check

In SDP_AddAttribute of sdp_db.cc, there is a possible out of bounds write due to an incorrect bounds check

In parseTrackFragmentRun() of MPEG4Extractor.cpp, there is a possible out of bounds read due to an integer overflow

In gatt_process_prep_write_rsp of gatt_cl.cc, there is a possible out of bounds write due to a missing bounds check

In lcsm_SendRrAcquiAssist of lcsm_bcm_assist.c, there is a possible out of bounds write due to a missing bounds check

In Pixel cellular firmware, there is a possible out of bounds write due to a missing bounds check

In sms_SendMmCpErrMsg of sms_MmConManagement.c, there is a possible out of bounds write due to a heap buffer overflow

In onStart of BluetoothSwitchPreferenceController.java, there is a possible permission bypass due to a confused deputy

Product: AndroidVersions: Android kernelAndroid ID: A-235292841References: N/A

In toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check

In toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check

Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238257000

Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238257002

Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238257004

Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238227323

Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238227324

Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238227328

a function called 'nla_parse', do not check the len of para, it will check nla_type (which can be controlled by userspace) with 'maxtype' (in this case, it is GSCAN_MAX), then it…

The path in this case is a little bit convoluted

In BT firmware, there is a possible out of bounds write due to a missing bounds check

The PowerVR GPU driver allows unprivileged apps to allocated pinned memory, unpin it (which makes it available to be freed), and continue using the page in GPU calls

The PowerVR GPU driver allows unprivileged apps to allocated pinned memory, unpin it (which makes it available to be freed), and continue using the page in GPU calls

Product: AndroidVersions: Android kernelAndroid ID: A-216363416References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-207975764References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-218701042References: N/A

In cd_CodeMsg of cd_codec.c, there is a possible out of bounds write due to a missing bounds check

Product: AndroidVersions: Android kernelAndroid ID: A-211727306References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-188935887References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-234657153References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-229632566References: N/A

In BuildDevIDResponse of miscdatabuilder.cpp, there is a possible out of bounds write due to a missing bounds check

In btif_dm_auth_cmpl_evt of btif_dm.cc, there is a possible vulnerability in Cross-Transport Key Derivation due to Weakness in Bluetooth Standard

remap_pfn_range' here may map out of size kernel memory (for example, may map the kernel area), and because the 'vma->vm_page_prot' can also be controlled by userspace, so…

Improper input validation in baseband prior to SMR Aug-2022 Release 1 allows attackers to cause integer overflow to heap overflow

'remap_pfn_range' here may map out of size kernel memory (for example, may map the kernel area), and because the 'vma->vm_page_prot' can also be controlled by userspace, so…

In bta_hf_client_handle_cind_list_item of bta_hf_client_at.cc, there is a possible out of bounds write due to a missing bounds check

In read_attr_value of gatt_db.cc, there is a possible out of bounds write due to a missing bounds check

android exported is used to set third-party app access permissions, and the default value of intent-filter is true

The UE and the EMM communicate with each other using NAS messages

Product: AndroidVersions: Android kernelAndroid ID: A-209324757References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-207116951References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-215565667References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-209421931References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-204956204References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-204891956References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-210083655References: N/A

In startLegacyVpnPrivileged of Vpn.java, there is a possible way to retrieve VPN credentials due to a protocol downgrade attack

In read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to an incorrect bounds check

In transportDec_OutOfBandConfig of tpdec_lib.cpp, there is a possible out of bounds write due to a heap buffer overflow