drt24

KillingInTheNameOf psneuter ashmem

(json)

CVE numbers: CVE-2011-1149 [citation-needed]
Coordinated disclosure?: false
Categories: system, kernel
Details: Android before 2.3 does not properly restrict access to the system property space, which allows local applications to bypass the application sandbox and gain privileges [citation-needed]
Discovered by: on: Unknown
Reported on: 2011-01-06 [c-skills-adb-trickery][archived]
Fixed on: 2010-07-13 [ashmem-fix-core], 2010-07-15 [ashmem-fix-kernel]
Fix released on: 2010-12-06 [citation-needed]
Affected versions: 1.5 -- 2.2.2 [citation-needed] regex: (1.[5-9].[0-9])|(2.(([0-1].[0-9])|(2.[0-9])))
Affected devices: all [citation-needed]
Affected manufacturers: all [citation-needed]
Fixed versions: 2.3 [citation-needed]
Submission: by: Daniel R. Thomas, on: 2013-09-04

exploid udev

(json)

CVE numbers: CVE-2009-1185 [citation-needed]
Coordinated disclosure?: false
Categories: kernel
Details: udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space. [CVE-2009-1185]
Discovered by: Sebastian ??? [c-skills-android-trickery][archived] on: 2010-07-15 [c-skills-android-trickery][archived]
Reported on: 2010-07-15 [c-skills-android-trickery][archived]
Fixed on: 2011-04-18 [netd-udev-fix]
Fix released on: 2011-07-25 [sprint-2.3.5-release#0][sprint-2.3.5-release#1]
Affected versions: 1.0-2.3.4 [citation-needed] regex: (1.[0-9].[0-9])|(2.(([0-2].[0-9])|(3.[0-4])))
Affected devices: all [citation-needed]
Affected manufacturers: all [citation-needed]
Fixed versions: 2.3.5_r1 [netd-udev-fix]
Submission: by: Daniel R. Thomas, on: 2013-09-04

RageAgainstTheCage adb

(json)

CVE numbers: CVE-2010-EASY [intrepidus-looking-at-c-skills][archived]
Coordinated disclosure?: false
Categories: system
Details: adb fails to check setuid return code and this can be caused to fail by the shell user already having RLIMIT_NPROC processes. [citation-needed]
Discovered by: Sebastian Krahmer [thesnkchrmr-ratc][archived] on: 2010-08-21 [c-skills-droid2][archived]
Reported on: Unknown
Fixed on: 2010-08-27 [rageagainstthecage-adb-patch]
Fix released on: Unknown
Affected versions: 1.6_r1-2.2_r1 [adb-setuid-bug-patch] regex: (1.[6-9].[0-9])|(2.((1.[0-9])|(2.0)))
Affected devices: Droid2, backflip and evo [c-skills-droid2][archived]
Affected manufacturers: all [rageagainstthecage-adb-patch]
Fixed versions: 2.2.2 and greater [android-security-2010-EASY-patches][archived], 2.2_r8, 2.3_r1 [rageagainstthecage-adb-patch]
Submission: by: Daniel R. Thomas, on: 2013-09-05

RageAgainstTheCage zygote

(json)

CVE numbers: ANDROID-3176774 [citation-needed]
Coordinated disclosure?: false
Categories: system
Details: Also known as Zimperlich [c-skills-zimperlich][archived]
Discovered by: on: Unknown
Reported on: Unknown
Fixed on: 2010-08-30 [dalvik-zygote], 2010-11-08 [dalvik-zygote-cherry]
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: all [citation-needed]
Fixed versions: 2.3.1_r1 [dalvik-zygote]
Submission: by: Daniel R. Thomas, on: 2013-09-06

levitator

(json)

CVE numbers: CVE-2011-1350 [citation-needed], CVE-2011-1352 [citation-needed]
Coordinated disclosure?: true
Categories: kernel
Details: Improper bounds checking in the PowerVR driver as used in versions of Android prior to 2.3.6 when copying user data to kernel memory allows a malicious local application to write to the same area of memory referenced in CVE-2011-1350, potentially allowing for arbitrary code execution and privilege escalation. [citation-needed]
Discovered by: Geremy Condra [security-focus-57900][archived] on: 2011-03-10 [CVE-2011-1350]
Reported on: Unknown
Fixed on: Unknown
Fix released on: 2011-09-02 [w-ard-ver-hist], 2011-09-29 [tag-android-2.3.6_r1]
Affected versions: 1.0 -- 2.3.5 [citation-needed] regex: (1.[0-9].[0-9])|(2.(([0-2].[0-9])|(3.[0-5])))
Affected devices: all [citation-needed]
Affected manufacturers: all [citation-needed]
Fixed versions: 2.3.6 [citation-needed]
Submission: by: Daniel R. Thomas, on: 2013-09-02

Gingerbreak

(json)

CVE numbers: CVE-2011-1823 [CVE-2011-1823]
Coordinated disclosure?: false
Categories: system
Details: The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges [citation-needed]
Discovered by: The Android Exploid Crew [citation-needed] on: Unknown
Reported on: 2011-04-21 [c-skills-gingerbreak][archived], 2011-04-21 [xda-forum-gingerbreak]
Fixed on: 2011-04-18 [patch-vold-gingerbreak], 2011-04-18 [patch-netd-gingerbreak], 2011-04-18 [patch-core-gingerbreak]
Fix released on: 2011-04-29 [productforums-ard-2.3.4]
Affected versions: 2.2, 2.3, 2.3.1, 3.0 [citation-needed] regex: (2.(([0-2].[0-9])|(3.[0-3])))|(3.0.[0-9])
Affected devices: all [citation-needed]
Affected manufacturers: all [citation-needed]
Fixed versions: 2.3.4 [tag-android-2.3.4_r1], 3.1 [ard-dev-3.1-release][archived]
Submission: by: Daniel R. Thomas, on: 2013-09-02

zergRush

(json)

CVE numbers: CVE-2011-3874 [citation-needed]
Coordinated disclosure?: false
Categories: system
Details: [android-issue-21681]
Discovered by: The Revolutionary development team [citation-needed] on: 2011-10-06 [github-zergrush]
Reported on: 2011-11-09 [android-issue-21681]
Fixed on: 2011-11-09 [android-issue-21681]
Fix released on: 2011-11-21 [tag-android-2.2.3_r1]
Affected versions: Android 2.2.x up to and including to 2.2.2, Android 2.3.x up to and including to 2.3.6 [citation-needed] regex: 2.(([0-1].[0-9])|(2.[0-2])|(3.[0-6]))
Affected devices: all [citation-needed]
Affected manufacturers: all [citation-needed]
Fixed versions: 2.2.3, 2.3.7, 3.x+ [citation-needed]
Submission: by: Daniel R. Thomas, on: 2013-08-28

TacoRoot

(json)

CVE numbers:
Coordinated disclosure?: false
Categories: permissions
Details: HTC recovery log on some devices is world writable and so can be deleted and symlinked to /data/local.prop to allow root on reboot, this is a appears to be a unstable exploit and requires the user to reboot into recovery mode [gh-cunninglogic-tacoroot][archived]
Discovered by: Justin Case (jcase) and Dan Rosenberg [gh-cunninglogic-tacoroot-sh][archived] on: 2012-01-01 [gh-cunninglogic-tacoroot-fc]
Reported on: 2011-12-29 [rootzwiki-tacoroot][archived]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: HTC [rootzwiki-tacoroot][archived]
Fixed versions:
Submission: by: Daniel R. Thomas, on: 2014-07-21; by: Thomas Coudray, on: 2014-03-07

NachoRoot

(json)

CVE numbers:
Coordinated disclosure?: false
Categories: permissions
Details: On ASUS Transformer Pime /data/sensors/AMI304_Config.ini is set world writable on boot and so a /data/local.prop symlink attack can be mounted [gh-cunninglogic-nachoroot-sh][archived]
Discovered by: Justin Case (jcase) [gh-cunninglogic-nachoroot-sh][archived] on: 2012-01-03 [gh-cunninglogic-nachoroot]
Reported on: 2012-01-03 [xda-nachoroot]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices: ASUS Transformer Prime [gh-cunninglogic-nachoroot]
Affected manufacturers: Asus [gh-cunninglogic-nachoroot]
Fixed versions:
Submission: by: Daniel R. Thomas, on: 2014-07-21; by: Thomas Coudray, on: 2014-03-07

Qualcomm Integer oveflow diagnostics

(json)

CVE numbers: CVE-2012-4220 [CVE-2012-4220], CVE-2012-4221 [CVE-2012-4221], CVE-2012-4222 [CVE-2012-4222]
Coordinated disclosure?: true
Categories: kernel
Details: QCIR-2012-00001-1: Multiple security vulnerabilities have been discovered in the handling of the diagchar_ioctl() and kgsl_ioctl() system call parameters for the diagnostics (DIAG) and KGSL graphics kernel drivers for Android. [QCIR-2012-00001-1][archived]
Discovered by: giantpune@gmail.com [QCIR-2012-00001-1][archived] on: 2012-04-30 [giantpune-email0]
Reported on: 2012-11-15 [QCIR-2012-00001-1][archived]
Fixed on: 2012-11-16 [QCIR-2012-00001-1][archived]
Fix released on: Unknown
Affected versions: 2.3 -- 4.2 released from CAF [QCIR-2012-00001-1][archived] regex:
Affected devices:
Affected manufacturers: Qualcomm [QCIR-2012-00001-1][archived]
Fixed versions:
Submission: by: Daniel R. Thomas, on: 2013-09-02; by: giantpune, on: 2014-10-17

Qualcomm missing checks put_user get_user

(json)

CVE numbers: CVE-2013-6282 [QCIR-2013-00010-1][archived]
Coordinated disclosure?: false
Categories: kernel
Details: Missing access checks in put_user/get_user kernel API (CVE-2013-6282 QCIR-2013-00010-1): The get_user and put_user API functions of the Linux kernel fail to validate the target address when being used on ARM v6k/v7 platforms. This functionality was originally implemented and controlled by the domain switching feature (CONFIG_CPU_USE_DOMAINS), which has been deprecated due to architectural changes. As a result, any kernel code using these API functions may introduce a security issue where none existed before. This allows an application to read and write kernel memory to, e.g., escalated privileges. [QCIR-2013-00010-1][archived]
Discovered by: Unknown, used in vroot exploit [QCIR-2013-00010-1][archived] on: 2013-09-06 [xda-developers-vroot]
Reported on: 2013-09-06 [xda-developers-vroot]
Fixed on: 2012-09-07 [msm-check_user_pointer-patch], 2013-07-15 [msm-check_user_pointer-patch]
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [QCIR-2013-00010-1][archived]
Fixed versions:
Submission: by: Daniel R. Thomas, on: 2013-11-20

APK duplicate file

(json)

CVE numbers: ANDROID-8219321 [citation-needed], CVE-2013-4787 [citation-needed]
Coordinated disclosure?: true
Categories: signature
Details: Android does not properly check cryptographic signatures for applications, which allows attackers to execute arbitrary code via an application package file (APK) that is modified in a way that does not violate the cryptographic signature. Android security bug 8219321. [citation-needed]
Discovered by: Jeff Forristal of Bluebox security [bluebox-master-key][archived] on: 2013-02-18 [bluebox-master-key][archived]
Reported on: 2013-07-03 [bluebox-master-key][archived]
Fixed on: 2013-02-18 [patch-apk-dup-file]
Fix released on: 2013-07-24 [verge-android-4.3]
Affected versions: 1.6-4.2 [citation-needed] regex: ([1-3].[0-9].[0-9])|(4.[0-2].[0-9])
Affected devices: all [citation-needed]
Affected manufacturers: all [citation-needed]
Fixed versions: 4.3_r0.9 [patch-apk-dup-file]
Submission: by: Daniel R. Thomas, on: 2013-09-02

Qualcomm Gandalf camera driver

(json)

CVE numbers: CVE-2013-2595 [QCIR-2013-00001-1][archived]
Coordinated disclosure?: true
Categories: kernel
Details: The camera driver provides several interfaces to user space clients. The user space clients communicate to the kernel via syscalls such as ioctl or mmap. The camera driver provides an uncontrolled mmap interface that allows an application with access to the device file to map physical memory exceeding the camera driver's memory into user space. A locally installed, unprivileged application can use this flaw to escalate privileges. [QCIR-2013-00001-1][archived]
Discovered by: alephzain alephzain1@gmail.com [QCIR-2013-00001-1][archived] on: 2013-03-15 [CVE-2013-2595]
Reported on: 2013-05-01 [xda-developers-gandalf]
Fixed on: 2013-05-01 [QCIR-2013-00001-1][archived]
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [citation-needed]
Fixed versions:
Submission: by: Daniel R. Thomas, on: 2013-11-06

Motochopper

(json)

CVE numbers: CVE-2013-2596 [citation-needed]
Coordinated disclosure?: false
Categories: kernel
Details: Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9 QCIR-2013-00004-1 [QCIR-2013-00004-1]
Discovered by: Dan Rosenberg [citation-needed] on: 2013-04-08 [citation-needed]
Reported on: 2013-04-08 [azimuth-unlock-moto-bootloader#0][azimuth-unlock-moto-bootloader#1]
Fixed on: 2013-04-19 [fb_mmap-patch]
Fix released on: 2013-07-17 [xda-developers-motochopper]
Affected versions: 4.1.2 [citation-needed] regex:
Affected devices: (Atrix Hd, Razr hd, Razr M, Qualcomm Msm8960) [citation-needed]
Affected manufacturers: Motorola [citation-needed], Qualcomm [QCIR-2013-00004-1]
Fixed versions: 4.1.2 build 9.8.1Q-79 [citation-needed]
Submission: by: Daniel R. Thomas, on: 2013-09-04

Qualcomm acdb audio buffer overflow

(json)

CVE numbers: CVE-2013-2597 [QCIR-2013-00002-1][archived]
Coordinated disclosure?: false
Categories: kernel
Details: The acdb audio driver provides an ioctl system call interface to user space clients for communication. When processing arguments passed to the ioctl handler, a user space supplied size is used to copy as many bytes from user space to a local stack buffer without proper bounds checking. An application with access to the /dev/msm_acdb device file (audio or system group) can use this flaw to, e.g., elevate privileges. QCIR-2013-00002-1 [QCIR-2013-00002-1][archived]
Discovered by: @fi01_IS01 [QCIR-2013-00002-1][archived], Xuxian Jiang [QCIR-2013-00002-1][archived] on: 2013-05-08 [twitter-fi01_IS01][archived]
Reported on: 2013-05-08 [twitter-fi01_IS01][archived]
Fixed on: 2013-06-21 [QCIR-2013-00002-1][archived]
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [QCIR-2013-00002-1][archived]
Fixed versions:
Submission: by: Daniel R. Thomas, on: 2013-11-08

Qualcomm Integer overflow camera

(json)

CVE numbers: CVE-2013-4736 [QCIR-2013-00005-1]
Coordinated disclosure?: false
Categories: kernel
Details: Integer overflow and signedness issue in camera JPEG engines (CVE-2013-4736) QCIR-2013-00005-1: The JPEG engines that are part of the camera driver provide an ioctl system call interface to user space clients for communication. When processing hardware commands ioctl calls, the drivers are incorrectly handling the number of commands included in the user space payload. This can lead to an integer overflow which subsequently results in the driver attempting to process hardware commands from out-of-bounds memory which can cause the kernel to crash. The same code also suffered from incorrectly treating the number of hardware commands as signed. [QCIR-2013-00005-1] Gemini JPEG encoder, Mercury JPEG decoder, and Jpeg1.0 common encoder/decoder contain an unspecified integer overflow condition during the handling of hardware command IOCTL calls that may allow a local attacker to cause a denial of service or potentially execute of arbitrary code. [osvdb-96924]
Discovered by: alephzain alephzain1@gmail.com [QCIR-2013-00005-1] on: Unknown
Reported on: 2013-08-29 [QCIR-2013-00005-1]
Fixed on: 2013-07-31 [jpeg-integer-overflow-patch], 2013-06-28 [overflow-ioctl_hw_cmds-patch], 2013-06-11 [signedness-hw_exec_cmds-patch]
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [QCIR-2013-00005-1]
Fixed versions:
Submission: by: Daniel R. Thomas, on: 2013-11-14

LG Sprite backup

(json)

CVE numbers: CVE-2013-3685 [citation-needed]
Coordinated disclosure?: true
Categories: system
Details: Race condition in Sprite Software's backup software, installed by OEM on LG Android devices. [fulldisclosure-2013-06-196]
Discovered by: Justin Case jcase@cunninglogic.com [fulldisclosure-2013-06-196] on: 2013-06-24 [fulldisclosure-2013-06-196]
Reported on: 2013-06-24 [fulldisclosure-2013-06-196]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: spritebud 1.3.24, 1.3.28 backup 2.5.4105, 2.5.4108 [citation-needed] regex:
Affected devices: (LG-E971:LG Optimus G, LG-E973:LG Optimus G, LG-E975:LG Optimus G, LG-E975K:LG Optimus G, LG-E975T:LG Optimus G, LG-E976:LG Optimus G, LG-E977:LG Optimus G, LG-F100K:LG Optimus Vu, LG-F100L:LG Optimus Vu, LG-F100S:LG Optimus Vu, LG-F120K:LG Optimus Vu, LG-F120L:LG Optimus LTE Tag, LG-F120S:LG Optimus LTE Tag, LG-F160K:LG Optimus LTE 2, LG-F160L:LG Optimus LTE 2, LG-F160LV:LG Optimus LTE 2, LG-F160S:LG Optimus LTE 2, LG-F180K:LG Optimus G, LG-F180L:LG Optimus G, LG-F180S:LG Optimus G, LG-F200K:LG Optimus Vu 2, LG-F200L:LG Optimus Vu 2, LG-F200S:LG Optimus Vu 2, LG-F240K:LG Optimus G Pro, LG-F240L:LG Optimus G Pro, LG-F240S:LG Optimus G Pro, LG-F260K:LG Optimus LTE 3, LG-F260L:LG Optimus LTE 3, LG-F260S:LG Optimus LTE 3, LG-L21:LG Optimus G, LG-LG870:LG (Unknown), LG-LS860:LG Mach, LG-LS970:LG Optimus G, LG-P760:LG Optimus L9, LG-P769:LG Optimus L9, LG-P780:LG Optimus L7, LG-P875:LG Optimus F5, LG-P875h:LG Optimus F5, LG-P880:LG Optimus 4X HD, LG-P940:LG Prada, LG-SU540:LG Prada 3.0, LG-SU870:LG Optimus 3D Cube, LG-US780:LG Lollipop) [fulldisclosure-2013-06-196]
Affected manufacturers: LG [citation-needed]
Fixed versions:
Submission: by: Daniel R. Thomas, on: 2013-08-28; by: Justin Case, on: 2014-02-08

APK unchecked name

(json)

CVE numbers: ANDROID-9950697 [citation-needed]
Coordinated disclosure?: false
Categories: signature
Details: APK signature verification does not check name lengths correctly, creating a difference between how the zip files are verified compared with how they are extracted which allows files in an existing APK to be replaced with new files. [saurik-19] Exploited by RockMyMoto [androidpolice-rockmymoto]
Discovered by: Jay Freeman (saurik) [saurik-19], Elliott Hughes enh@google.com [android-issue-57851] on: 2013-06-30 [saurik-19]
Reported on: 2013-11-01 [saurik-19], 2013-11-01 [CydiaImpactor-396439244782067713]
Fixed on: 2013-07-21 [patch-unchecked-name]
Fix released on: Unknown
Affected versions: 4.3 and earlier [citation-needed] regex: ([1-3].[0-9].[0-9])|(4.[0-3].[0-9])
Affected devices: all [citation-needed]
Affected manufacturers: all [citation-needed]
Fixed versions: 4.4 [patch-unchecked-name]
Submission: by: Daniel R. Thomas, on: 2013-11-14

APK unsigned shorts

(json)

CVE numbers: ANDROID-9695860 [citation-needed]
Coordinated disclosure?: true
Categories: signature
Details: File offsets in zips are supposed to be unsigned but were interpreted as signed allowing different content to be verified from the content executed. [citation-needed]
Discovered by: on: Unknown
Reported on: 2013-07-10 [sina-shorts], 2013-07-10 [ard-police-shorts]
Fixed on: 2013-07-03 [patch-unsigned-shorts]
Fix released on: 2013-07-24 [verge-android-4.3]
Affected versions: 1.6-4.2 [citation-needed] regex: ([1-3].[0-9].[0-9])|(4.[0-2].[0-9])
Affected devices: all [citation-needed]
Affected manufacturers: all [citation-needed]
Fixed versions: 4.3_r1 [patch-unsigned-shorts]
Submission: by: Daniel R. Thomas, on: 2013-09-04

Defy republic init_runit

(json)

CVE numbers: CVE-2013-4777 [CVE-2013-4777], CVE-2013-5933 [CVE-2013-5933]
Coordinated disclosure?: true
Categories: permissions
Details: A certain configuration of Android 2.3.7 on the Motorola Defy XT phone for Republic Wireless uses init to create a /dev/socket/init_runit socket that listens for shell commands, which allows local users to gain privileges by interacting with a LocalSocket object. [CVE-2013-4777] Stack-based buffer overflow in the sub_E110 function in init in a certain configuration of Android 2.3.7 on the Motorola Defy XT phone for Republic Wireless allows local users to gain privileges or cause a denial of service (memory corruption) by writing a long string to the /dev/socket/init_runit socket that is inconsistent with a certain length value that was previously written to this socket. [CVE-2013-5933]
Discovered by: Justin Case [plus-jcase-defy-republic] on: 2013-07-09 [plus-jcase-defy-republic]
Reported on: 2013-09-24 [plus-jcase-defy-republic]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: 2.3.7 [citation-needed] regex:
Affected devices: Defy Xt on Republic Wireless [CVE-2013-4777]
Affected manufacturers: Motorola [citation-needed]
Fixed versions:
Submission: by: Daniel R. Thomas, on: 2013-11-06; by: Laurent Simon, on: 2013-10-07

Qualcomm stack buffer overflow camera

(json)

CVE numbers: CVE-2013-4738 [QCIR-2013-00008-1][archived], CVE-2013-4739 [QCIR-2013-00008-1][archived]
Coordinated disclosure?: true
Categories: kernel
Details: Stack-based buffer overflow and memory disclosure in camera driver QCIR-2013-00008-1: A stack-based buffer overflow and a kernel memory disclosure vulnerability have been discovered in the system call handlers of the camera driver. [QCIR-2013-00008-1][archived]
Discovered by: Jonathan Salwan of the Sysdream Security Lab [QCIR-2013-00008-1][archived] on: Unknown
Reported on: 2013-10-15 [QCIR-2013-00008-1][archived]
Fixed on: 2013-07-31 [msm-camera-dequeue-patch], 2013-08-09 [msm-bound-check-patch]
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [citation-needed]
Fixed versions:
Submission: by: Daniel R. Thomas, on: 2013-11-20

keystore buffer

(json)

CVE numbers: CVE-2014-3100 [securityinteligence-keystore]
Coordinated disclosure?: true
Categories: system
Details: Stack-based buffer overflow in the encode_key function in /system/bin/keystore in the KeyStore service in Android 4.3 allows attackers to execute arbitrary code, and consequently obtain sensitive key information or bypass intended restrictions on cryptographic operations, via a long key name. [CVE-2014-3100]
Discovered by: Roee Hay (IBM) [securityinteligence-keystore] on: 2013-09-09 [keystore-patch]
Reported on: 2014-06-23 [securityinteligence-keystore]
Fixed on: 2013-09-09 [keystore-patch]
Fix released on: 2013-10-31 [android-4.4-release]
Affected versions: 4.3 [securityinteligence-keystore] regex: 4.3.[0-9]
Affected devices: all [securityinteligence-keystore]
Affected manufacturers: all [securityinteligence-keystore]
Fixed versions: 4.4 [keystore-patch]
Submission: by: Daniel R. Thomas, on: 2014-07-17; by: Laurent Simon, on: 2014-06-24

Qualcomm Goodix driver procfs

(json)

CVE numbers: CVE-2013-4740 [QCIR-2013-00009-1][archived], CVE-2013-6122 [QCIR-2013-00009-1][archived]
Coordinated disclosure?: true
Categories: kernel
Details: Multiple memory corruption issues and race condition in Goodix gt915 touchscreen driver procfs handler (CVE-2013-4740 CVE-2013-6122) QCIR-2013-00009-1: Multiple issues have been identified in the Goodix gt915 touchscreen driver for Android. The issues were found in the write handler of the procfs entry created by the driver, which by default is readable and writeable to users without any specific privileges. [QCIR-2013-00009-1][archived]
Discovered by: Jonathan Salwan of the Sysdream Security Lab [QCIR-2013-00009-1][archived] on: Unknown
Reported on: 2013-11-07 [QCIR-2013-00009-1][archived]
Fixed on: 2013-09-23 [msm-goodix-patch][archived]
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [QCIR-2013-00009-1][archived]
Fixed versions:
Submission: by: Daniel R. Thomas, on: 2013-11-20

Qualcomm out of bounds camera

(json)

CVE numbers: CVE-2013-6123 [QCIR-2014-00001-1][archived]
Coordinated disclosure?: true
Categories: kernel
Details: Out of bounds array access in camera driver (CVE-2013-6123): The camera driver provides an ioctl system call interface to user space clients for communication. When processing this communication, the msm_ioctl_server, msm_server_send_ctrl, and msm_ctrl_cmd_done functions use a user-supplied value as an index to the server_queue array for read and write operations without any boundary checks. A local application with access to the camera device nodes can use this flaw to, e.g., elevate privileges. [QCIR-2014-00001-1][archived]
Discovered by: alephzain alephzain1@gmail.com [QCIR-2014-00001-1][archived] on: 2013-10-10 [msm-camera-valid-patch]
Reported on: 2014-01-10 [QCIR-2014-00001-1][archived]
Fixed on: 2013-12-09 [msm-camera-bounds-patch], 2013-10-10 [msm-camera-valid-patch]
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [QCIR-2014-00001-1][archived]
Fixed versions:
Submission: by: Daniel R. Thomas, on: 2014-04-16

Qualcomm chown init scripts

(json)

CVE numbers: CVE-2013-6124 [QCIR-2014-00002-1][archived]
Coordinated disclosure?: true
Categories: permissions
Details: Insecure owner/permission changes in init shell scripts (CVE-2013-6124): During the device start-up phase, several init shell scripts are executed with root privileges to configure various aspects of the system. During this process, standard toolchain commands such as chown or chmod are used to, e.g., change the owner of the sensor settings file to the system user. As these commands follow symbolic links (symlinks), an attacker with write access to these resources is able to conduct symlink attacks and thus change for example the owner of an arbitrary file to system. This flaw can be used to, e.g., elevate privileges. [QCIR-2014-00002-1][archived]
Discovered by: Jon Sawyer [QCIR-2014-00002-1][archived] on: 2013-10-15 [CVE-2013-6124]
Reported on: 2014-02-19 [QCIR-2014-00002-1][archived]
Fixed on: 2013-11-14 [init-symlink-patch], 2013-10-30 [chown-symlink-patch], 2013-12-14 [chmod-symlink-patch], 2013-12-16 [chmod-args-patch]
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [QCIR-2014-00002-1][archived]
Fixed versions:
Submission: by: Daniel R. Thomas, on: 2014-04-16

TwerkMyMoto

(json)

CVE numbers:
Coordinated disclosure?: false
Categories: permissions
Details: Motorola Razr I (x86) 4.1.2 root exploit, silly permissions bug. symlink /data/logs/core to uevent_helper [plus-jcase-twerkmymoto]
Discovered by: Justin Case (jcase) [plus-jcase-twerkmymoto] on: 2013-11-24 [twerk-my-moto-commit][archived]
Reported on: 2013-11-24 [plus-jcase-twerkmymoto]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: 4.1.2 [plus-jcase-twerkmymoto] regex: 4.1.2
Affected devices: Motorola Razr I (x86) [plus-jcase-twerkmymoto]
Affected manufacturers: Motorola [plus-jcase-twerkmymoto]
Fixed versions:
Submission: by: Daniel R. Thomas, on: 2014-07-17; by: Laurent Simon, on: 2014-06-05

vold asec

(json)

CVE numbers:
Coordinated disclosure?: true
Categories: system
Details: Insufficient paramter checking for asec container creation allows an asec container to be mounted over part of the filesystem using directory traversal if the app has the ASEC_* permissions such as ASEC_CREATE [cassidian-vold-asec] There is an adb tethered root explot for motorola phones [xda-developers-pie-exploit]
Discovered by: Justin Case (jcase) [android-paper] on: Unknown
Reported on: 2014-06-03 [cassidian-vold-asec]
Fixed on: 2014-01-27 [vold-asec-patch]
Fix released on: 2014-06-02 [android-4.4.3_r1]
Affected versions: 2.2.1_r1-4.4.2 [vold-asec-implementation][cassidian-vold-asec] regex: (2.((2.[1-9])|([3-9].[0-9])))|(3.[0-9].[0-9])|(4.(([0-3].[0-9])|(4.[0-2])))
Affected devices: Motorola devices [xda-developers-pie-exploit], Proper SEAndroid policies do block this, Nexus 5, Samsung S4/5/Note3, LG Flex, Sony Z2 devices etc should have this mitigated. Nexus 4 if it hasn't been updated to 4.4.3 nor reset since OTA to 4.4 [plus-jcase-pie]
Affected manufacturers: all [vold-asec-implementation]
Fixed versions: 4.4.3 [cassidian-vold-asec]
Submission: by: Daniel R. Thomas, on: 2014-07-16; by: Laurent Simon, on: 2014-06-04; by: Laurent Simon, on: 2015-10-09; by: Daniel Carter, on: 2019-07-08

WeakSauce

(json)

CVE numbers: CVE-2014-3847 [twitter-jcase-weaksaucecve]
Coordinated disclosure?: false
Categories:
Details: WeakSauce is an exploit for some HTC devices. It was compatible with the HTC One m7 & m7 on Verizon [xda-developers-weaksauce]
Discovered by: jcase [xda-developers-weaksauce] on: Unknown
Reported on: 2014-03-29 [xda-developers-weaksauce]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices: HTC One m7 & m7 on Verizon [xda-developers-weaksauce]
Affected manufacturers: HTC [xda-developers-weaksauce]
Fixed versions:
Submission: by: Daniel R. Thomas, on: 2016-03-18; by: Stephan Kollmann, on: 2015-10-14

Fake ID

(json)

CVE numbers:
Coordinated disclosure?: true
Categories: signature
Details: The software does not properly validate an application's certificate chain. An application can supply a specially crafted application identity certificate to impersonate a privileged application and gain access to vendor-specific device administration extensions. The vulnerability resides in the createChain() and findCert() functions of the Android JarUtils class. [securitytracker-1030654] Google bug 13678484 [blackhat-briefing-fakeid]
Discovered by: Jeff Forristal of Bluebox [bluebox-fakeid] on: Unknown
Reported on: 2014-07-29 [ars-fake-id]
Fixed on: 2014-04-17 [fakeid-patch]
Fix released on: Unknown
Affected versions: 2.1 -- 4.4 [ars-fake-id] regex: (2.[1-9].[0-9])|(3.[0-9].[0-9])|(4.[0-3].[0-9])|(4.4.[0-4])
Affected devices:
Affected manufacturers: all [bluebox-fakeid]
Fixed versions: there is no single, specific “fixed” version of Android. In fact, multiple vendors are maintaining the same prior version number, and only patching the functionality. We have confirmed “fixed” versions existing within the ranges of 4.1, 4.2, 4.3, and 4.4 [bluebox-fakeid]
Submission: by: Khilan Gudka, on: 2014-07-29; by: Daniel R. Thomas, on: 2014-09-09; by: Jeff Forristal, on: 2014-09-11

pty race

(json)

CVE numbers: CVE-2014-0196 [includesecurity-pty-race]
Coordinated disclosure?: true
Categories: kernel
Details: The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings. [nvd-CVE-2014-0196] Taking a look at the git history of the Linux kernel it turns out that all kernels between c56a00a165712fd73081f40044b1e64407bb1875 (march 2012) and 64325a3be08d364a62ee8f84b2cf86934bc2544a (january 2013) are not affected by this vuln as tty_insert_flip_string_fixed_flag() was internally locked there. [includesecurity-pty-race] Fixed from 4291086b1f081b869c6d79e5b7441633dc3ace00 and present from d945cb9cce20ac7143c2de8d88b187f62db99bdc [pty-race-patch]
Discovered by: Jiri Slaby jslaby@suse.cz [pty-race-patch] on: 2014-04-29 [novel-pty-race-bug]
Reported on: 2014-04-30 [novel-pty-race-bug], 2014-05-05 [openwall-pty-race]
Fixed on: 2014-04-29 [openwall-pty-race]
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: all [includesecurity-pty-race]
Fixed versions:
Submission: by: Daniel R. Thomas, on: 2014-09-17

StumpRoot

(json)

CVE numbers:
Coordinated disclosure?: false
Categories:
Details: Vulnerability affecting LG devices released between 2012 and 2014 [xda-developers-stumproot]
Discovered by: thecubed [xda-developers-stumproot] on: Unknown
Reported on: 2014-08-17 [xda-developers-stumproot]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices: Verizon LG G3, T-Mobile LG G3, AT&T LG G3, Sprint LG G3, D852G Videotron 10C, D852 Rogers 10B, D852 Bell 10B, Flex D959 TMobile, LG-D855, LG-D858, LG-D855, LG-D851, LG-F400L [xda-developers-stumproot]
Affected manufacturers: LG [xda-developers-stumproot]
Fixed versions:
Submission: by: Daniel R. Thomas, on: 2016-03-18; by: Stephan Kollmann, on: 2015-10-14

dhcpd buffer overrun

(json)

CVE numbers: CVE-2014-7912 [dhcpd-fix], CVE-2014-7913 [dhcpd-fix]
Coordinated disclosure?: true
Categories: network
Details: The specific flaw exists within the parsing of the DHCP options in a DHCP ACK packet. The vulnerability is triggered when the LENGTH of an option, when added to the current read position, exceeds the actual length of the DHCP options buffer. An attacker can leverage this vulnerability to execute code on the device. [ZDI-15-093] This remote code execution vulnerability executes code as the dhcp user which limit's its severity [citation-needed]
Discovered by: Jüri Aedla [ZDI-15-093] on: 2014-11-13 [ZDI-15-093]
Reported on: 2015-03-12 [ZDI-15-093]
Fixed on: 2014-11-15 [dhcpd-fix]
Fix released on: Unknown
Affected versions: All versions below 5.1 [dhcpd-circl] regex: ([1-4].[0-9].[0-9])|(5.0.[0-9])
Affected devices: all [dhcpd-circl]
Affected manufacturers: all [dhcpd-circl]
Fixed versions: 5.1 [dhcpd-circl]
Submission: by: Laurent Simon, on: 2015-03-14; by: Daniel R. Thomas, on: 2015-03-24

pipe inatomic

(json)

CVE numbers: CVE-2015-1805 [CVE-2015-1805]
Coordinated disclosure?: true
Categories: kernel
Details: The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an 'I/O vector array overrun.' [CVE-2015-1805] This is a known issue in the upstream Linux kernel that was fixed in April 2014 but wasn’t called out as a security fix and assigned CVE-2015-1805 until February 2, 2015. On February 19, 2016, C0RE Team notified Google that the issue could be exploited on Android and a patch was developed to be included in an upcoming regularly scheduled monthly update. On March 15, 2016 Google received a report from Zimperium that this vulnerability had been abused on a Nexus 5 device. Google has confirmed the existence of a publicly available rooting application that abuses this vulnerability on Nexus 5 and Nexus 6 to provide the device user with root privileges. [android-advisory-2016-03-18]
Discovered by: Red Hat [redhatbug-1202855] on: 2015-02-02 [android-advisory-2016-03-18], 2015-03-17 [redhatbug-1202855]
Reported on: 2015-06-06 [openwall-2015-06-06-2]
Fixed on: 2015-06-16 [pipe-inatomic-patch3.4]
Fix released on: Unknown
Affected versions: Kernel versions 3.4, 3.10 and 3.14 [android-advisory-2016-03-18] regex:
Affected devices: all [android-advisory-2016-03-18]
Affected manufacturers: all [citation-needed]
Fixed versions: Kernel versions from 3.18 and patched kernels [android-advisory-2016-03-18]
Submission: by: Daniel R. Thomas, on: 2016-03-21

PingPongRoot

(json)

CVE numbers: CVE-2015-3636 [avs-test-pingpong][archived]
Coordinated disclosure?: false
Categories:
Details: Wen Xu and wushi of KeenTeam discovered that users allowed to create ping sockets can use them to crash the system and, on 32-bit architectures, for privilege escalation. However, by default, no users on a Debian system have access to ping sockets. [dsa-3290]
Discovered by: Wen Xu and wushi of KeenTeam [dsa-3290] on: Unknown
Reported on: 2015-05-08 [xda-developers-pingpongroot]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices: Samsung Galaxy S6 Edge [xda-developers-pingpongroot], HTC One (M9) [xda-developers-pingpongroot], Samsung Galaxy S6 [xda-developers-pingpongroot]
Affected manufacturers: Samsung [xda-developers-pingpongroot], HTC [xda-developers-pingpongroot]
Fixed versions: 5.0.2,5.1.1 [xda-developers-pingpongroot]
Submission: by: Daniel R. Thomas, on: 2016-03-18; by: Stephan Kollmann, on: 2015-10-14

Samsung WifiHs20UtilityService

(json)

CVE numbers: CVE-2015-7888 [projectzero-489]
Coordinated disclosure?: true
Categories: system
Details: A path traversal vulnerability was found in the WifiHs20UtilityService. This service is running on a Samsung S6 Edge device, and may be present on other Samsung device models. WifiHs20UtilityService reads any files placed in /sdcard/Download/cred.zip, and unzips this file into /data/bundle. Directory traversal in the path of the zipped contents allows an attacker to write a controlled file to an arbitrary path as the system user. [citation-needed]
Discovered by: Mark Brand [projectzeroblog-huntinggalaxy] on: 2015-07-29 [citation-needed]
Reported on: 2015-07-29 [citation-needed]
Fixed on: 2015-10-22 [projectzero-489]
Fix released on: Unknown
Affected versions: regex:
Affected devices: Samsung S6 Edge and may be present in other Samsung device models [projectzero-489]
Affected manufacturers: Samsung [projectzero-489]
Fixed versions:
Submission: by: Daniel R. Thomas, on: 2016-03-18; by: Stephan Kollmann, on: 2015-10-14

certifi-gate

(json)

CVE numbers:
Coordinated disclosure?: false
Categories: app
Details: Certifi-gate is a set of vulnerabilities in the authorization methods between mobile Remote Support Tool (mRST) apps and system-level plugs on a device. mRSTs allow remote personnel to offer customers personalized technical support for their devices by replicating a device’s screen and by simulating screen clicks at a remote console. If exploited, Certifi-gate allows malicious applications to gain unrestricted access to a device silently, elevating their privileges to allow access to the user data and perform a variety of actions usually only available to the device owner. [checkpoint-certifigate-blog][archived]
Discovered by: Check Point Software Technologies Ltd. [checkpoint-certificate-report] on: Unknown
Reported on: 2015-08-06 [checkpoint-certifigate-blog][archived]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers:
Fixed versions:
Submission: by: Laurent Simon, on: 2015-08-07; by: Daniel R. Thomas, on: 2016-06-01

Stagefright2

(json)

CVE numbers: CVE-2015-6602 [zimperium-stagefright2], CVE-2015-3876 [android-security-october][archived]
Coordinated disclosure?: true
Categories: system, network
Details: Meet Stagefright 2.0, a set of two vulnerabilities that manifest when processing specially crafted MP3 audio or MP4 video files. The first vulnerability (in libutils) impacts almost every Android device since version 1.0 released in 2008. We found methods to trigger that vulnerability in devices running version 5.0 and up using the second vulnerability (in libstagefright). Google assigned CVE-2015-6602 to vulnerability in libutils. [zimperium-stagefright2]
Discovered by: Joshua J. Drake [zimperium-stagefright2] on: 2015-08-15 [zimperium-stagefright2]
Reported on: 2015-10-01 [zimperium-stagefright2]
Fixed on: Unknown
Fix released on: 2015-10-05 [register-stagefright2]
Affected versions: 5.1 and below [android-security-october][archived] regex: ([1-4].[0-9].[0-9])|(5.0.[0-9])|(5.1.[0-1])
Affected devices: all [zimperium-stagefright2]
Affected manufacturers: all [zimperium-stagefright2]
Fixed versions: 5.1.1, LMY48T or later, LMY48W [android-security-october][archived]
Submission: by: Daniel R. Thomas, on: 2015-10-06; by: Laurent Simon, on: 2015-10-02; by: Alastair R. Beresford, on: 2015-10-01