In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
google android - |
Over the last several years, as the Android ecosystem matured, widely-distributed malware with rooting capabilities has become rare. But its rarity doesn’t mean it’s not still a threat.
By definition, rooting malware is extremely dangerous because it can gain privileged access to the Android operating system. This enables the malware to grant itself further permissions, change system settings and install additional malware, steps that usually require user interaction. Armed with these ...
MediaTek chipset flaw already exploited in the wild
Google has emitted its latest monthly batch of Android security fixes, addressing a total of 70 CVE-listed vulnerabilities.
The March update includes 17 patches for flaws described as critical remote code execution holes, though only one is actually documented due to the other 16 residing in closed-source Qualcomm components.
The documented flaw, CVE-2020-0032, lies within the open-source Android media framework that can be exploited by opening a booby-trapped file that Google is dis...
MediaTek chipset flaw already exploited in the wild Android owners – you'll want to get these latest security patches, especially for this nasty Bluetooth hijack flaw
Google has emitted its latest monthly batch of Android security fixes, addressing a total of 70 CVE-listed vulnerabilities.
The March update includes 17 patches for flaws described as critical remote code execution holes, though only one is actually documented due to the other 16 residing in closed-source Qualcomm components.
The documented flaw, CVE-2020-0032, lies within the open-source Android media framework that can be exploited by opening a booby-trapped file that Google is dis...
Google has addressed a high-severity flaw in MediaTek’s Command Queue driver that developers said affects millions of devices – and which has an exploit already circulating in the wild.
Also in its March 2020 Android Security bulletin, issued this week, Google disclosed and patched a critical security vulnerability in the Android media framework, which could enable remote code execution within the context of a privileged process.
The critical bug (CVE-2020-0032) can be exploited ...
Vulmon