Description
In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010443; Issue ID: MSV-3966.
CVSS breakdown
CVSS 3.1
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- Google / Android14.0 – 14.0
- Google / Android15.0 – 15.0
- linuxfoundation / yocto4.0 – 4.0
- MediaTek, Inc. / MT2718, MT2737, MT6835, MT6878, MT6886, MT6897, MT6899, MT6982, MT6985, MT6986, MT6986D, MT6989, MT6990, MT6991, MT8676, MT8678, MT8755, MT8893Android 14.0, 15.0 / openWRT 21.02, 23.05 / Yocto 4.0 / RDK-B 24Q1 / Zephyr 3.7.0 – Android 14.0, 15.0 / openWRT 21.02, 23.05 / Yocto 4.0 / RDK-B 24Q1 / Zephyr 3.7.0
- openwrt / openwrt21.02.0 – 21.02.0
- openwrt / openwrt23.05.0 – 23.05.0
- rdkcentral / rdk-b2024q1 – 2024q1
- zephyrproject / zephyr3.7.0 – 3.7.0
Updated 40m ago · 8 sources