SB2023030649 - Multiple vulnerabilities in Google Android

Description

This security bulletin contains information about 55 secuirty vulnerabilities.

1) Integer overflow (CVE-ID: CVE-2022-25705)

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in Modem. A local application can execute arbitrary code.

2) Buffer over-read (CVE-ID: CVE-2022-40535)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in WLAN. A remote attacker can perform a denial of service (DoS) attack.

3) Incorrect Type Conversion or Cast (Type Conversion) (CVE-ID: CVE-2022-40531)

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in WLAN. A local application can execute arbitrary code.

4) Integer overflow (CVE-ID: CVE-2022-40530)

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in WLAN. A local application can execute arbitrary code.

5) Reachable Assertion (CVE-ID: CVE-2022-40527)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in WLAN Embedded SW. A remote attacker can perform a denial of service (DoS) attack.

6) Double Free (CVE-ID: CVE-2022-40515)

The vulnerability allows a remote attacker to read and manipulate data.

The vulnerability exists due to improper input validation in Video. A remote attacker can read and manipulate data.

7) Buffer over-read (CVE-ID: CVE-2022-33309)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in WLAN Firmware.. A remote attacker can perform a denial of service (DoS) attack.

8) Buffer overflow (CVE-ID: CVE-2022-33278)

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in HLOS. A local application can execute arbitrary code.

9) Reachable Assertion (CVE-ID: CVE-2022-33272)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in Modem. A remote attacker can perform a denial of service (DoS) attack.

10) Reachable Assertion (CVE-ID: CVE-2022-33254)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in Modem. A remote attacker can perform a denial of service (DoS) attack.

11) Reachable Assertion (CVE-ID: CVE-2022-33250)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in Modem. A remote attacker can perform a denial of service (DoS) attack.

12) Reachable Assertion (CVE-ID: CVE-2022-33244)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in Modem. A remote attacker can perform a denial of service (DoS) attack.

13) Improper Authentication (CVE-ID: CVE-2022-33242)

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in Qualcomm IPC. A local application can execute arbitrary code.

14) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2022-25709)

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in Data Modem. A local application can execute arbitrary code.

15) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2022-25694)

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in MODEM. A local application can execute arbitrary code.

16) Out-of-bounds write (CVE-ID: CVE-2021-33655)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in FBIOPUT_VSCREENINFO IOCTL. A local user can trigger an out-of-bounds write error and execute arbitrary code with elevated privileges.

17) Buffer overflow (CVE-ID: CVE-2022-25655)

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in WLAN HAL. A local application can execute arbitrary code.

18) Improper Validation of Array Index (CVE-ID: CVE-2022-33256)

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper input validation in Multi-mode call processor. A remote attacker can execute arbitrary code.

19) Stack-based buffer overflow (CVE-ID: CVE-2022-33213)

The vulnerability allows a remote application to execute arbitrary code.

The vulnerability exists due to improper input validation in MODEM. A remote application can execute arbitrary code.

20) Buffer overflow (CVE-ID: CVE-2022-40540)

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in Linux Kernel. A local application can execute arbitrary code.

21) Improper Validation of Array Index (CVE-ID: CVE-2022-40537)

The vulnerability allows a remote attacker to read and manipulate data.

The vulnerability exists due to improper input validation in Bluetooth HOST. A remote attacker can read and manipulate data.

22) Information Exposure (CVE-ID: CVE-2022-22075)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper input validation in Graphics. A local application can gain access to sensitive information.

23) Use After Free (CVE-ID: CVE-2022-47460)

The vulnerability allows a local application to damange or delete data.

The vulnerability exists due to a memory corruption due to a use after free within the gpu device in Kerenl. A local application can damange or delete data.

24) Missing Authorization (CVE-ID: CVE-2022-47462)

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a missing permission check within the telephone service in Android. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code.

25) Information Exposure (CVE-ID: CVE-2022-47461)

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a missing permission check within the telephone service in Android. A local application can read and manipulate data.

26) Out-of-bounds write (CVE-ID: CVE-2022-47459)

The vulnerability allows a local application to read, manipulate or delete data.

The vulnerability exists due to a possible missing params check within the wlan driver in Kerenl. A local application can read, manipulate or delete data.

27) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2023-20623)

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper locking within ion. A local application can execute arbitrary code.

28) Improper Input Validation (CVE-ID: CVE-2023-20621)

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to a missing bounds check within tinysys. A local privileged application can execute arbitrary code.

29) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2023-20620)

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to a logic error within adsp. A local privileged application can execute arbitrary code.

30) Input validation error (CVE-ID: CVE-2022-20499)

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of untrusted input within the Bluetooth component. A local application can perform a denial of service (DoS) attack.

31) Input validation error (CVE-ID: CVE-2023-20910)

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in Android Wi-Fi component. A local application can pass specially crafted input to the system and perform a denial of service (DoS) attack.

32) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-20957)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in Android System component. A local application can escalate privileges on the device.

33) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-20953)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in Android System component. A local application can escalate privileges on the device.

34) Information disclosure (CVE-ID: CVE-2023-20962)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to excessive data output by the Android System. A local application can gain access to sensitive information.

35) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-20955)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in Android System component. A local application can escalate privileges on the device.

36) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-20936)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in Android System component. A local application can escalate privileges on the device.

37) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-20931)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in Android System component. A local application can escalate privileges on the device.

38) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-20926)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in Android System component. A local application can escalate privileges on the device.

39) Input validation error (CVE-ID: CVE-2023-20954)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in the System component. A remote attacker can pass specially crafted input to the system and execute arbitrary code.

40) Input validation error (CVE-ID: CVE-2023-20951)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in the System component. A remote attacker can pass specially crafted input to the system and execute arbitrary code.

41) Input validation error (CVE-ID: CVE-2023-20964)

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the Android Framework. A local application can perform a denial of service (DoS) attack.

42) Information disclosure (CVE-ID: CVE-2023-20958)

The vulnerability allows a local application to gain access to sensitive data.

The vulnerability exists due to excessive data output by the Android Framework. A local application can gain access to sensitive information.

43) Information disclosure (CVE-ID: CVE-2023-20956)

The vulnerability allows a local application to gain access to sensitive data.

The vulnerability exists due to excessive data output by the Android Framework media codecs. A local application can gain access to sensitive information.

44) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-20966)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in Android System component. A local application can escalate privileges on the device.

45) Information disclosure (CVE-ID: CVE-2022-20467)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to excessive data output by the Android System. A local application can gain access to sensitive information.

46) Information disclosure (CVE-ID: CVE-2023-20952)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to excessive data output by the Android System. A local application can gain access to sensitive information.

47) Information disclosure (CVE-ID: CVE-2023-20929)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to excessive data output by the Android System Tethering. A local application can gain access to sensitive information.

48) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-20960)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in Android System component. A local application can escalate privileges on the device.

49) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-20959)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in Android System component. A local application can escalate privileges on the device.

50) Information disclosure (CVE-ID: CVE-2022-4452)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to excessive data output by the Android System. A local application can gain access to sensitive information.

51) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-20947)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in Android Framework permission controller. A local application can escalate privileges on the device.

52) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-20906)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in Android Framework. A local application can escalate privileges on the device.

53) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-20963)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in Android Framework. A local application can escalate privileges on the device.

Note, the vulnerability is being actively exploited in the wild.

54) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-20911)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in Android Framework. A local application can escalate privileges on the device.

55) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-20917)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in Android Framework. A local application can escalate privileges on the device.

Remediation

Install update from vendor's website.

References

• https://source.android.com/docs/security/bulletin/2023-03-01
• https://source.android.com/docs/security/bulletin/2023-03-01#2023-03-01-security-patch-level-vulnerability-details
• https://github.com/davinci1010/pinduoduo_backdoor
• https://techcrunch.com/2023/03/20/google-flags-apps-made-by-popular-chinese-e-commerce-giant-as-malware/