Action not permitted
Modal body text goes here.
Modal Title
Modal Body
wid-sec-w-2024-3203
Vulnerability from csaf_certbund
Published
2024-10-15 22:00
Modified
2024-10-15 22:00
Summary
Pixel Patchday Oktober 2024: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Angriff
Ein anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen, einen Denial-of-Service-Zustand zu erzeugen oder vertrauliche Informationen offenzulegen.
Betroffene Betriebssysteme
- Android
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Das Android Betriebssystem ist eine quelloffene Plattform f\u00fcr mobile Ger\u00e4te. Die Basis bildet der Linux-Kernel.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erh\u00f6hen, einen Denial-of-Service-Zustand zu erzeugen oder vertrauliche Informationen offenzulegen.", "title": "Angriff" }, { "category": "general", "text": "- Android", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-3203 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3203.json" }, { "category": "self", "summary": "WID-SEC-2024-3203 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3203" }, { "category": "external", "summary": "Pixel Update Bulletin vom 2024-10-15", "url": "https://source.android.com/docs/security/bulletin/pixel/2024-10-01" } ], "source_lang": "en-US", "title": "Pixel Patchday Oktober 2024: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-10-15T22:00:00.000+00:00", "generator": { "date": "2024-10-16T11:14:55.501+00:00", "engine": { "name": "BSI-WID", "version": "1.3.8" } }, "id": "WID-SEC-W-2024-3203", "initial_release_date": "2024-10-15T22:00:00.000+00:00", "revision_history": [ { "date": "2024-10-15T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "Pixel", "product": { "name": "Google Android Pixel", "product_id": "T034609", "product_identification_helper": { "cpe": "cpe:/o:google:android:pixel" } } } ], "category": "product_name", "name": "Android" } ], "category": "vendor", "name": "Google" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-28818", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-28818" }, { "cve": "CVE-2024-44098", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-44098" }, { "cve": "CVE-2024-44099", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-44099" }, { "cve": "CVE-2024-44100", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-44100" }, { "cve": "CVE-2024-44101", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-44101" }, { "cve": "CVE-2024-47012", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-47012" }, { "cve": "CVE-2024-47013", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-47013" }, { "cve": "CVE-2024-47014", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-47014" }, { "cve": "CVE-2024-47015", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-47015" }, { "cve": "CVE-2024-47016", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-47016" }, { "cve": "CVE-2024-47017", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-47017" }, { "cve": "CVE-2024-47018", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-47018" }, { "cve": "CVE-2024-47019", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-47019" }, { "cve": "CVE-2024-47020", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-47020" }, { "cve": "CVE-2024-47021", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-47021" }, { "cve": "CVE-2024-47022", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-47022" }, { "cve": "CVE-2024-47023", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-47023" }, { "cve": "CVE-2024-47024", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-47024" }, { "cve": "CVE-2024-47025", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-47025" }, { "cve": "CVE-2024-47026", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-47026" }, { "cve": "CVE-2024-47027", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-47027" }, { "cve": "CVE-2024-47028", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-47028" }, { "cve": "CVE-2024-47029", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-47029" }, { "cve": "CVE-2024-47030", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-47030" }, { "cve": "CVE-2024-47031", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-47031" }, { "cve": "CVE-2024-47033", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-47033" }, { "cve": "CVE-2024-47034", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-47034" }, { "cve": "CVE-2024-47035", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-47035" }, { "cve": "CVE-2024-47041", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Google Pixel Android. Diese Fehler wurden von Google noch nicht im Detail beschrieben. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um erweiterte Privilegien zu erlangen, einen Denial-of-Service-Zustand zu erzeugen oder Informationen offenzulegen. Einige der Schwachstellen erfordern einen Benutzereingriff, um sie erfolgreich auszunutzen." } ], "product_status": { "known_affected": [ "T034609" ] }, "release_date": "2024-10-15T22:00:00.000+00:00", "title": "CVE-2024-47041" } ] }
cve-2024-44099
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-25 19:02
Severity ?
EPSS score ?
Summary
There is a possible Local bypass of user interaction due to an insecure default value. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
References
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "android", "vendor": "google", "versions": [ { "status": "affected", "version": "android_kernel" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-44099", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-10-25T18:57:14.191733Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T19:02:23.265Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "There is a possible Local bypass of user interaction due to an insecure default value. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation." } ], "problemTypes": [ { "descriptions": [ { "description": "Information disclosure", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T10:34:03.377Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-44099", "datePublished": "2024-10-25T10:34:03.377Z", "dateReserved": "2024-08-19T16:32:38.650Z", "dateUpdated": "2024-10-25T19:02:23.265Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-47025
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-25 16:14
Severity ?
EPSS score ?
Summary
In ppmp_protect_buf of drm_fw.c, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
References
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "android", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:h:google:pixel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "pixel", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-47025", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-10-25T15:41:16.103856Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T16:14:33.314Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "In ppmp_protect_buf of drm_fw.c, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation." } ], "problemTypes": [ { "descriptions": [ { "description": "Information disclosure", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T10:34:06.191Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-47025", "datePublished": "2024-10-25T10:34:06.191Z", "dateReserved": "2024-09-16T19:14:14.860Z", "dateUpdated": "2024-10-25T16:14:33.314Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-47021
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-28 20:18
Severity ?
EPSS score ?
Summary
In sms_ExtractCbLanguage of sms_CellBroadcast.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
References
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-47021", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-10-28T17:20:23.418881Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-28T20:18:27.173Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "In sms_ExtractCbLanguage of sms_CellBroadcast.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation." } ], "problemTypes": [ { "descriptions": [ { "description": "Information disclosure", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T10:34:05.495Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-47021", "datePublished": "2024-10-25T10:34:05.495Z", "dateReserved": "2024-09-16T18:51:44.743Z", "dateUpdated": "2024-10-28T20:18:27.173Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-47022
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-28 20:17
Severity ?
EPSS score ?
Summary
Android before 2024-10-05 on Google Pixel devices allows information disclosure in the ACPM component, A-331255656.
References
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "android", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:h:google:pixel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "pixel", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-47022", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-10-28T17:19:59.091043Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "description": "CWE-noinfo Not enough information", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-28T20:17:19.827Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "Android before 2024-10-05 on Google Pixel devices allows information disclosure in the ACPM component, A-331255656." } ], "problemTypes": [ { "descriptions": [ { "description": "Information disclosure", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T13:37:00.000Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-47022", "datePublished": "2024-10-25T10:34:05.677Z", "dateReserved": "2024-09-16T19:14:14.859Z", "dateUpdated": "2024-10-28T20:17:19.827Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-47034
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-25 15:56
Severity ?
EPSS score ?
Summary
there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
References
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "android", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:h:google:pixel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "pixel", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-47034", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-10-25T15:39:01.506385Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T15:56:04.139Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation." } ], "problemTypes": [ { "descriptions": [ { "description": "Information disclosure", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T10:34:07.639Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-47034", "datePublished": "2024-10-25T10:34:07.639Z", "dateReserved": "2024-09-16T19:21:19.200Z", "dateUpdated": "2024-10-25T15:56:04.139Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-47029
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-25 15:57
Severity ?
EPSS score ?
Summary
In TrustySharedMemoryManager::GetSharedMemory of ondevice/trusty/trusty_shared_memory_manager.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
References
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "android", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:h:google:pixel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "pixel", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-47029", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-10-25T15:40:20.421337Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T15:57:26.159Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "In TrustySharedMemoryManager::GetSharedMemory of ondevice/trusty/trusty_shared_memory_manager.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation." } ], "problemTypes": [ { "descriptions": [ { "description": "Information disclosure", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T10:34:06.850Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-47029", "datePublished": "2024-10-25T10:34:06.850Z", "dateReserved": "2024-09-16T19:14:14.860Z", "dateUpdated": "2024-10-25T15:57:26.159Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-47020
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-28 20:19
Severity ?
EPSS score ?
Summary
Android before 2024-10-05 on Google Pixel devices allows information disclosure in the ABL component, A-331966488.
References
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-47020", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-10-28T17:20:32.373490Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "description": "CWE-noinfo Not enough information", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-28T20:19:11.314Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "Android before 2024-10-05 on Google Pixel devices allows information disclosure in the ABL component, A-331966488." } ], "problemTypes": [ { "descriptions": [ { "description": "Information disclosure", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T13:37:00.000Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-47020", "datePublished": "2024-10-25T10:34:05.317Z", "dateReserved": "2024-09-16T18:51:44.743Z", "dateUpdated": "2024-10-28T20:19:11.314Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-47033
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-25 16:12
Severity ?
EPSS score ?
Summary
In lwis_allocator_free of lwis_allocator.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "android", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:h:google:pixel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "pixel", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-47033", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-10-25T15:39:15.992579Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-416", "description": "CWE-416 Use After Free", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T16:12:27.582Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "In lwis_allocator_free of lwis_allocator.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation." } ], "problemTypes": [ { "descriptions": [ { "description": "Elevation of privilege", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T10:34:07.429Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-47033", "datePublished": "2024-10-25T10:34:07.429Z", "dateReserved": "2024-09-16T19:21:19.200Z", "dateUpdated": "2024-10-25T16:12:27.582Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-47019
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-25 14:43
Severity ?
EPSS score ?
Summary
In ProtocolEmbmsSaiListAdapter::Init() of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware compromise required. User Interaction is not needed for exploitation.
References
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-47019", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-10-25T14:38:40.578249Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T14:43:12.598Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "In ProtocolEmbmsSaiListAdapter::Init() of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware compromise required. User Interaction is not needed for exploitation." } ], "problemTypes": [ { "descriptions": [ { "description": "Information disclosure", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T10:34:05.150Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-47019", "datePublished": "2024-10-25T10:34:05.150Z", "dateReserved": "2024-09-16T18:51:44.743Z", "dateUpdated": "2024-10-25T14:43:12.598Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-47023
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-28 20:04
Severity ?
EPSS score ?
Summary
there is a possible man-in-the-middle attack due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "android", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:h:google:pixel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "pixel", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-47023", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-10-28T17:19:52.571604Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "description": "CWE-noinfo Not enough information", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-28T20:04:06.039Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "there is a possible man-in-the-middle attack due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation." } ], "problemTypes": [ { "descriptions": [ { "description": "Elevation of privilege", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T10:34:05.871Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-47023", "datePublished": "2024-10-25T10:34:05.871Z", "dateReserved": "2024-09-16T19:14:14.859Z", "dateUpdated": "2024-10-28T20:04:06.039Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-44100
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-25 18:46
Severity ?
EPSS score ?
Summary
Android before 2024-10-05 on Google Pixel devices allows information disclosure in the modem component, A-299774545.
References
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "android", "vendor": "google", "versions": [ { "status": "affected", "version": "android_kernel" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-44100", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-10-25T18:43:22.487800Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-276", "description": "CWE-276 Incorrect Default Permissions", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T18:46:51.786Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "Android before 2024-10-05 on Google Pixel devices allows information disclosure in the modem component, A-299774545." } ], "problemTypes": [ { "descriptions": [ { "description": "Information disclosure", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T13:37:00.000Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-44100", "datePublished": "2024-10-25T10:34:03.553Z", "dateReserved": "2024-08-19T16:32:38.651Z", "dateUpdated": "2024-10-25T18:46:51.786Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-47017
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-25 14:49
Severity ?
EPSS score ?
Summary
In ufshc_scsi_cmd of ufs.c, there is a possible stack variable use after free due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "android", "vendor": "google", "versions": [ { "status": "affected", "version": "android_kernel" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-47017", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-10-25T14:46:54.150746Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-416", "description": "CWE-416 Use After Free", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T14:49:08.403Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "In ufshc_scsi_cmd of ufs.c, there is a possible stack variable use after free due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation." } ], "problemTypes": [ { "descriptions": [ { "description": "Elevation of privilege", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T10:34:04.790Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-47017", "datePublished": "2024-10-25T10:34:04.790Z", "dateReserved": "2024-09-16T18:51:44.742Z", "dateUpdated": "2024-10-25T14:49:08.403Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-47014
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-25 18:32
Severity ?
EPSS score ?
Summary
Android before 2024-10-05 on Google Pixel devices allows privilege escalation in the ABL component, A-330537292.
References
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "android", "vendor": "google", "versions": [ { "status": "affected", "version": "android_kernel" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-47014", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-10-25T18:29:10.278021Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-276", "description": "CWE-276 Incorrect Default Permissions", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T18:32:58.224Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "Android before 2024-10-05 on Google Pixel devices allows privilege escalation in the ABL component, A-330537292." } ], "problemTypes": [ { "descriptions": [ { "description": "Elevation of privilege", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T13:37:00.000Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-47014", "datePublished": "2024-10-25T10:34:04.299Z", "dateReserved": "2024-09-16T18:51:44.742Z", "dateUpdated": "2024-10-25T18:32:58.224Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-47041
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-25 15:52
Severity ?
EPSS score ?
Summary
In valid_address of syscall.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "android", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:h:google:pixel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "pixel", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-47041", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-10-25T15:36:36.203558Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T15:52:00.823Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "In valid_address of syscall.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation." } ], "problemTypes": [ { "descriptions": [ { "description": "Elevation of privilege", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T10:34:08.185Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-47041", "datePublished": "2024-10-25T10:34:08.185Z", "dateReserved": "2024-09-16T19:21:19.201Z", "dateUpdated": "2024-10-25T15:52:00.823Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-47027
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-25 16:12
Severity ?
EPSS score ?
Summary
In sm_mem_compat_get_vmm_obj of lib/sm/shared_mem.c, there is a possible arbitrary physical memory access due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "android", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:h:google:pixel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "pixel", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-47027", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-10-25T15:40:52.589658Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T16:12:48.479Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "In sm_mem_compat_get_vmm_obj of lib/sm/shared_mem.c, there is a possible arbitrary physical memory access due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation." } ], "problemTypes": [ { "descriptions": [ { "description": "Elevation of privilege", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T10:34:06.522Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-47027", "datePublished": "2024-10-25T10:34:06.522Z", "dateReserved": "2024-09-16T19:14:14.860Z", "dateUpdated": "2024-10-25T16:12:48.479Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-44098
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-25 16:15
Severity ?
EPSS score ?
Summary
In lwis_device_event_states_clear_locked of lwis_event.c, there is a possible privilege escalation due to a double free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "android", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:h:google:pixel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "pixel", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-44098", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-10-25T15:41:37.704566Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-415", "description": "CWE-415 Double Free", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T16:15:09.381Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "In lwis_device_event_states_clear_locked of lwis_event.c, there is a possible privilege escalation due to a double free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation." } ], "problemTypes": [ { "descriptions": [ { "description": "Elevation of privilege", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T10:34:02.971Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-44098", "datePublished": "2024-10-25T10:34:02.971Z", "dateReserved": "2024-08-19T16:32:38.650Z", "dateUpdated": "2024-10-25T16:15:09.381Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-47024
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-25 16:14
Severity ?
EPSS score ?
Summary
In vring_size of external/headers/include/virtio/virtio_ring.h, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "android", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:h:google:pixel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "pixel", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-47024", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-10-25T15:41:27.378005Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound", "lang": "en", "type": "CWE" } ] }, { "descriptions": [ { "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T16:14:53.163Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "In vring_size of external/headers/include/virtio/virtio_ring.h, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation." } ], "problemTypes": [ { "descriptions": [ { "description": "Elevation of privilege", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T10:34:06.036Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-47024", "datePublished": "2024-10-25T10:34:06.036Z", "dateReserved": "2024-09-16T19:14:14.859Z", "dateUpdated": "2024-10-25T16:14:53.163Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-47012
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-25 18:39
Severity ?
EPSS score ?
Summary
In mm_GetMobileIdIndexForNsUpdate of mm_GmmPduCodec.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "android", "vendor": "google", "versions": [ { "status": "affected", "version": "android_kernel" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-47012", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-10-25T18:36:59.692784Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-276", "description": "CWE-276 Incorrect Default Permissions", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T18:39:01.508Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "In mm_GetMobileIdIndexForNsUpdate of mm_GmmPduCodec.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation." } ], "problemTypes": [ { "descriptions": [ { "description": "Elevation of privilege", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T10:34:03.942Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-47012", "datePublished": "2024-10-25T10:34:03.942Z", "dateReserved": "2024-09-16T18:51:44.742Z", "dateUpdated": "2024-10-25T18:39:01.508Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-47031
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-28 20:00
Severity ?
EPSS score ?
Summary
Android before 2024-10-05 on Google Pixel devices allows privilege escalation in the ABL component, A-329163861.
References
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "android", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:h:google:pixel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "pixel", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-47031", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-10-28T17:19:28.557464Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "description": "CWE-noinfo Not enough information", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-28T20:00:53.088Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "Android before 2024-10-05 on Google Pixel devices allows privilege escalation in the ABL component, A-329163861." } ], "problemTypes": [ { "descriptions": [ { "description": "Elevation of privilege", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T13:37:00.000Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-47031", "datePublished": "2024-10-25T10:34:07.253Z", "dateReserved": "2024-09-16T19:14:14.860Z", "dateUpdated": "2024-10-28T20:00:53.088Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-47013
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-25 18:36
Severity ?
EPSS score ?
Summary
In pmucal_rae_handle_seq_int of flexpmu_cal_rae.c, there is a possible arbitrary write due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "android", "vendor": "google", "versions": [ { "status": "affected", "version": "android_kernel" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-47013", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-10-25T18:34:19.919544Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-276", "description": "CWE-276 Incorrect Default Permissions", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T18:36:10.859Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "In pmucal_rae_handle_seq_int of flexpmu_cal_rae.c, there is a possible arbitrary write due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation." } ], "problemTypes": [ { "descriptions": [ { "description": "Elevation of privilege", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T10:34:04.130Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-47013", "datePublished": "2024-10-25T10:34:04.130Z", "dateReserved": "2024-09-16T18:51:44.742Z", "dateUpdated": "2024-10-25T18:36:10.859Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-28818
Vulnerability from cvelistv5
Published
2024-06-05 00:00
Modified
2024-08-02 00:56
Severity ?
EPSS score ?
Summary
An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 2400, Exynos Modem 5123, Exynos Modem 5300. The baseband software does not properly check states specified by the RRC (Radio Resource Control) module. This can lead to disclosure of sensitive information.
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-28818", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-07-01T15:41:34.362965Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-07-01T15:42:00.234Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T00:56:58.144Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://semiconductor.samsung.com/support/quality-support/product-security-updates/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "descriptions": [ { "lang": "en", "value": "An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 2400, Exynos Modem 5123, Exynos Modem 5300. The baseband software does not properly check states specified by the RRC (Radio Resource Control) module. This can lead to disclosure of sensitive information." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AC:H/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2024-06-25T19:43:35.944146", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "url": "https://semiconductor.samsung.com/support/quality-support/product-security-updates/" } ] } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2024-28818", "datePublished": "2024-06-05T00:00:00", "dateReserved": "2024-03-11T00:00:00", "dateUpdated": "2024-08-02T00:56:58.144Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-47018
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-25 14:45
Severity ?
EPSS score ?
Summary
In pmucal_rae_handle_seq_int of flexpmu_cal_rae.c, there is a possible out of bounds read due to a buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
References
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-47018", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-10-25T14:44:48.548436Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T14:45:54.221Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "In pmucal_rae_handle_seq_int of flexpmu_cal_rae.c, there is a possible out of bounds read due to a buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation." } ], "problemTypes": [ { "descriptions": [ { "description": "Information disclosure", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T10:34:04.977Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-47018", "datePublished": "2024-10-25T10:34:04.977Z", "dateReserved": "2024-09-16T18:51:44.743Z", "dateUpdated": "2024-10-25T14:45:54.221Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-47015
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-25 14:55
Severity ?
EPSS score ?
Summary
In ProtocolMiscHwConfigChangeAdapter::GetData() of protocolmiscadapter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware compromise required. User Interaction is not needed for exploitation.
References
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-47015", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-10-25T14:55:03.382661Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T14:55:51.007Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "In ProtocolMiscHwConfigChangeAdapter::GetData() of protocolmiscadapter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware compromise required. User Interaction is not needed for exploitation." } ], "problemTypes": [ { "descriptions": [ { "description": "Information disclosure", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T10:34:04.460Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-47015", "datePublished": "2024-10-25T10:34:04.460Z", "dateReserved": "2024-09-16T18:51:44.742Z", "dateUpdated": "2024-10-25T14:55:51.007Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-47028
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-25 16:12
Severity ?
EPSS score ?
Summary
In ffu_flash_pack of ffu.c, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
References
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "android", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:h:google:pixel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "pixel", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-47028", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-10-25T15:40:41.039017Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T16:12:38.787Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "In ffu_flash_pack of ffu.c, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation." } ], "problemTypes": [ { "descriptions": [ { "description": "Information disclosure", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T10:34:06.682Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-47028", "datePublished": "2024-10-25T10:34:06.682Z", "dateReserved": "2024-09-16T19:14:14.860Z", "dateUpdated": "2024-10-25T16:12:38.787Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-47016
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-25 14:53
Severity ?
EPSS score ?
Summary
there is a possible privilege escalation due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "android", "vendor": "google", "versions": [ { "status": "affected", "version": "android_kernel" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-47016", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-10-25T14:49:53.344219Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-276", "description": "CWE-276 Incorrect Default Permissions", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T14:53:50.030Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "there is a possible privilege escalation due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation." } ], "problemTypes": [ { "descriptions": [ { "description": "Elevation of privilege", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T10:34:04.628Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-47016", "datePublished": "2024-10-25T10:34:04.628Z", "dateReserved": "2024-09-16T18:51:44.742Z", "dateUpdated": "2024-10-25T14:53:50.030Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-47026
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-25 16:12
Severity ?
EPSS score ?
Summary
In gsc_gsa_rescue of gsc_gsa.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
References
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "android", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:h:google:pixel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "pixel", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-47026", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-10-25T15:41:05.744302Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T16:12:59.109Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "In gsc_gsa_rescue of gsc_gsa.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation." } ], "problemTypes": [ { "descriptions": [ { "description": "Information disclosure", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T10:34:06.352Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-47026", "datePublished": "2024-10-25T10:34:06.352Z", "dateReserved": "2024-09-16T19:14:14.860Z", "dateUpdated": "2024-10-25T16:12:59.109Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-47030
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-28 20:02
Severity ?
EPSS score ?
Summary
Android before 2024-10-05 on Google Pixel devices allows information disclosure in the ACPM component, A-315191818.
References
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "android", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:h:google:pixel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "pixel", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-47030", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-10-28T17:19:37.344149Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "description": "CWE-noinfo Not enough information", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-28T20:02:02.939Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "Android before 2024-10-05 on Google Pixel devices allows information disclosure in the ACPM component, A-315191818." } ], "problemTypes": [ { "descriptions": [ { "description": "Information disclosure", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T13:37:00.000Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-47030", "datePublished": "2024-10-25T10:34:07.037Z", "dateReserved": "2024-09-16T19:14:14.860Z", "dateUpdated": "2024-10-28T20:02:02.939Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-44101
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-25 18:41
Severity ?
EPSS score ?
Summary
there is a possible Null Pointer Dereference (modem crash) due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
References
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "android", "vendor": "google", "versions": [ { "status": "affected", "version": "android_kernel" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-44101", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-10-25T18:40:03.594911Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T18:41:53.980Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "there is a possible Null Pointer Dereference (modem crash) due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation." } ], "problemTypes": [ { "descriptions": [ { "description": "Denial of service", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T10:34:03.747Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-44101", "datePublished": "2024-10-25T10:34:03.747Z", "dateReserved": "2024-08-19T16:32:38.651Z", "dateUpdated": "2024-10-25T18:41:53.980Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-47035
Vulnerability from cvelistv5
Published
2024-10-25 10:34
Modified
2024-10-25 16:00
Severity ?
EPSS score ?
Summary
In vring_init of external/headers/include/virtio/virtio_ring.h, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "android", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:h:google:pixel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "pixel", "vendor": "google", "versions": [ { "lessThan": "*", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-47035", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-10-25T15:36:48.049546Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T16:00:28.134Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Android", "vendor": "Google", "versions": [ { "status": "affected", "version": "Android kernel" } ] } ], "descriptions": [ { "lang": "en", "value": "In vring_init of external/headers/include/virtio/virtio_ring.h, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation." } ], "problemTypes": [ { "descriptions": [ { "description": "Elevation of privilege", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-25T10:34:07.817Z", "orgId": "83238938-5644-45f0-9007-c0392bcf6222", "shortName": "Google_Devices" }, "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2024-10-01" } ] } }, "cveMetadata": { "assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222", "assignerShortName": "Google_Devices", "cveId": "CVE-2024-47035", "datePublished": "2024-10-25T10:34:07.817Z", "dateReserved": "2024-09-16T19:21:19.200Z", "dateUpdated": "2024-10-25T16:00:28.134Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.