2022

In SAEMM_MiningCodecTableWithMsgIE of SAEMM_RadioMessageCodec.c, there is a possible out of bounds read due to a missing

In SAECOMM_CopyBufferBytes of SAECOMM_Utility.c, there is a possible out of bounds read due to an incorrect bounds check

In SAECOMM_SetDcnIdForPlmn of SAECOMM_DbManagement.c, there is a possible out of bounds read due to a missing bounds che

In SetDecompContextDb of RohcDeCompContextOfRbId.cpp, there is a possible out of bounds write due to a missing bounds ch

Product: AndroidVersions: Android kernelAndroid ID: A-211081867References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-204541506References: N/A

In TBD of TBD, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of

In Pixel firmware, there is a possible exposure of sensitive memory due to a missing bounds check. This could lead to lo

In sec_media_protect of media.c, there is a possible EoP due to an integer overflow. This could lead to local escalation

In ppmpu_set of ppmpu.c, there is a possible EoP due to an integer overflow. This could lead to local escalation of priv

In sendChunk of WirelessCharger.cpp, there is a possible out of bounds write due to a missing bounds check. This could l

In getWpcAuthChallengeResponse of WirelessCharger.cpp, there is a possible out of bounds read due to a missing bounds ch

In updateStart of WirelessCharger.cpp, there is a possible out of bounds write due to a missing bounds check. This could

In pop_descriptor_string of BufferDescriptor.h, there is a possible out of bounds read due to a missing bounds check. Th

In ppmp_validate_secbuf of drm_fw.c, there is a possible information disclosure due to improper input validation. This c

In ppmpu_set of ppmpu.c, there is a possible information disclosure due to a logic error in the code. This could lead to

In valid_va_sec_mfc_check of drm_access_control.c, there is a possible information disclosure due to improper input vali

In valid_va_secbuf_check of drm_access_control.c, there is a possible ID due to improper input validation. This could le

In sysmmu_map of sysmmu.c, there is a possible EoP due to a precondition check failure. This could lead to local escalat

In ppmp_validate_wsm of drm_fw.c, there is a possible EoP due to improper input validation. This could lead to local esc

In valid_out_of_special_sec_dram_addr of drm_access_control.c, there is a possible EoP due to improper input validation.

In valid_out_of_special_sec_dram_addr of drm_access_control.c, there is a possible EoP due to improper input validation.

In page_number of shared_mem.c, there is a possible code execution in secure world due to improper input validation. Thi

In ppmp_unprotect_mfcfw_buf of drm_fw.c, there is a possible out of bounds write due to improper input validation. This

In ppmp_unprotect_mfcfw_buf of drm_fw.c, there is a possible out of bounds write due to improper input validation. This

In the Pixel camera driver, there is a possible use after free due to a logic error in the code. This could lead to loca

In ufdt_do_one_fixup of ufdt_overlay.c, there is a possible out of bounds write due to an incorrect bounds check. This c

In RadioImpl::setCdmaBroadcastConfig of ril_service_legacy.cpp, there is a possible stack clash leading to memory corrup

In RadioImpl::setGsmBroadcastConfig of ril_service_legacy.cpp, there is a possible stack clash leading to memory corrupt

In OemSimAuthRequest::encode of wlandata.cpp, there is a possible out of bounds write due to a missing bounds check. Thi

In externalOnRequest of rilapplication.cpp, there is a possible out of bounds write due to a missing bounds check. This

In read_ppmpu_info of drm_fw.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead

In sec_sysmmu_info of drm_fw.c, there is a possible out of bounds read due to improper input validation. This could lead

In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission ch

In extract_metadata of dm-android-verity.c, there is a possible way to corrupt kernel memory due to a use after free. Th

Product: AndroidVersions: Android kernelAndroid ID: A-230660904References: N/A

In thermal_cooling_device_stats_update of thermal_sysfs.c, there is a possible out of bounds write due to improper input

In (TBD) of (TBD), there is a possible way to corrupt kernel memory due to a use after free. This could lead to local es

In pppol2tp_create of l2tp_ppp.c, there is a possible use after free due to a race condition. This could lead to local e

In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This could lead to local es

In _ufdt_output_strtab_to_fdt of ufdt_convert.c, there is a possible out of bounds write due to an incorrect bounds chec

In TBD of ufdt_convert, there is a possible out of bounds read due to memory corruption. This could lead to local escala

In various functions of ap_input_processor.c, there is a possible way to record audio during a phone call due to a logic

In TBD of aud_hal_tunnel.c, there is a possible memory corruption due to a use after free. This could lead to local esca

Product: AndroidVersions: Android kernelAndroid ID: A-212623833References: N/A

In revokeOwnPermissionsOnKill of PermissionManager.java, there is a possible way to determine whether an app is installe

In registerReceivers of DeviceCapabilityListener.java, there is a possible way to change preferred TTY mode due to a per

In MessageQueueBase of MessageQueueBase.h, there is a possible out of bounds read due to a missing bounds check. This co

In launchConfigNewNetworkFragment of NetworkProviderSettings.java, there is a possible way for the guest user to add a n

In ufdt_get_node_by_path_len of ufdt_convert.c, there is a possible out of bounds read due to a missing bounds check. Th