Google Pixel Improper Authorization Vulnerability

Google Pixel Out-of-Bounds Write Vulnerability

In handle_notification_response of btif_rc.cc, there is a possible out of bounds write due to a missing bounds check

there is a possible man-in-the-middle attack due to a logic error in the code

In multiple functions of gl_proc.c, there is a buffer overwrite due to a missing bounds check

In gattServerSendResponseNative of com_android_bluetooth_gatt.cpp, there is a possible out of bounds stack write due to a missing bounds check

In installPackageLI of PackageManagerService.java, there is a possible permissions bypass

In String16 of String16.cpp, there is a possible out of bounds write due to an integer overflow

In checkPermissions of RecognitionService.java, there is a possible permissions bypass due to a missing permission check

In valid_address of syscall.c, there is a possible out of bounds read due to an incorrect bounds check

In vring_init of external/headers/include/virtio/virtio_ring.h, there is a possible out of bounds write due to a logic error in the code

In lwis_allocator_free of lwis_allocator.c, there is a possible memory corruption due to a use after free

In sm_mem_compat_get_vmm_obj of lib/sm/shared_mem.c, there is a possible arbitrary physical memory access due to improper input validation

In vring_size of external/headers/include/virtio/virtio_ring.h, there is a possible out of bounds write due to an integer overflow

In pvmp3_get_main_data_size of pvmp3_get_main_data_size.cpp, there is a possible buffer overread due to a missing bounds check

Android before 2024-10-05 on Google Pixel devices allows information disclosure in the ACPM component, A-331255656

Android before 2024-10-05 on Google Pixel devices allows privilege escalation in the ABL component, A-329163861

In lwis_device_event_states_clear_locked of lwis_event.c, there is a possible privilege escalation due to a double free