Google Pixel Improper Authorization Vulnerability

Google Pixel Out-of-Bounds Write Vulnerability

In handle_app_cur_val_response of dtif_rc.cc, there is a possible stack buffer overflow due to a missing bounds check

In handle_notification_response of btif_rc.cc, there is a possible out of bounds write due to a missing bounds check

there is a possible man-in-the-middle attack due to a logic error in the code

In multiple functions of gl_proc.c, there is a buffer overwrite due to a missing bounds check

In gattServerSendResponseNative of com_android_bluetooth_gatt.cpp, there is a possible out of bounds stack write due to a missing bounds check

In installPackageLI of PackageManagerService.java, there is a possible permissions bypass

In String16 of String16.cpp, there is a possible out of bounds write due to an integer overflow

In checkPermissions of RecognitionService.java, there is a possible permissions bypass due to a missing permission check

In valid_address of syscall.c, there is a possible out of bounds read due to an incorrect bounds check

In vring_init of external/headers/include/virtio/virtio_ring.h, there is a possible out of bounds write due to a logic error in the code

In lwis_allocator_free of lwis_allocator.c, there is a possible memory corruption due to a use after free

In sm_mem_compat_get_vmm_obj of lib/sm/shared_mem.c, there is a possible arbitrary physical memory access due to improper input validation

In vring_size of external/headers/include/virtio/virtio_ring.h, there is a possible out of bounds write due to an integer overflow

In pvmp3_get_main_data_size of pvmp3_get_main_data_size.cpp, there is a possible buffer overread due to a missing bounds check

Android before 2024-10-05 on Google Pixel devices allows information disclosure in the ACPM component, A-331255656

Android before 2024-10-05 on Google Pixel devices allows privilege escalation in the ABL component, A-329163861

In lwis_device_event_states_clear_locked of lwis_event.c, there is a possible privilege escalation due to a double free

In sw49408_irq_runtime_engine_debug of touch_sw49408.c, there is a possible out of bounds write due to an incorrect bounds check

In store_cmd of ftm4_pdc.c, there is a possible out of bounds write due to an incorrect bounds check

In __unregister_prot_hook and packet_release of af_packet.c, there is a possible use-after-free due to improper locking

In sg_remove_scat of scsi/sg.c, there is a possible memory corruption due to an unusual root cause

In oemCallback of ril.cpp, there is a possible out of bounds write due to an integer overflow

In the MTK_FLP_MSG_HAL_DIAG_REPORT_DATA_NTF handler of flp2hal_- interface.c, there is a possible stack buffer overflow due to a missing bounds check

In gt1x_debug_write_proc and gt1x_tool_write of drivers/input/touchscreen/mediatek/GT1151/gt1x_generic.c and gt1x_tools.c, there is a possible out of bounds write due to a…

In /proc/driver/wmt_dbg driver, there are several possible out of bounds writes

In fm_set_stat of mediatek FM radio driver, there is a possible OOB write due to improper input validation

In WMT_unlocked_ioctl of MTK WMT device driver, there is a possible OOB write due to a missing bounds check

In rpc_msg_handler and related handlers of drivers/misc/mediatek/eccci/port_rpc.c, there is a possible out of bounds write due to an incorrect bounds check

In mtk_cfg80211_vendor_packet_keep_alive_start and mtk_cfg80211_vendor_set_config of drivers/misc/mediatek/connectivity/wlan/gen2/os/linux/gl_vendor.c, there is a possible OOB…

In mtk_p2p_wext_set_key of drivers/misc/mediatek/connectivity/wlan/gen2/os/linux/gl_p2p.c, there is a possible OOB write due to improper input validation

In procfile_write of drivers/misc/mediatek/connectivity/wlan/gen2/os/linux/gl_proc.c, there is a possible OOB write due to a missing bounds check

In get_binary of vendor/mediatek/proprietary/hardware/connectivity/gps/gps_hal/src/data_coder.c, there is a possible out of bounds write due to a missing bounds check

In rpc_msg_handler and related handlers of drivers/misc/mediatek/eccci/port_rpc.c, there is a possible out of bounds write due to an incorrect bounds check

there is a possible out of bounds read due to a missing bounds check

In TrustySharedMemoryManager::GetSharedMemory of ondevice/trusty/trusty_shared_memory_manager.cc, there is a possible out of bounds read due to an incorrect bounds check

In gsc_gsa_rescue of gsc_gsa.c, there is a possible out of bounds read due to an incorrect bounds check

In ppmp_protect_buf of drm_fw.c, there is a possible information disclosure due to a logic error in the code

Android before 2024-10-05 on Google Pixel devices allows information disclosure in the ACPM component, A-315191818

In ffu_flash_pack of ffu.c, there is a possible out of bounds read due to an integer overflow