CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Samsung Mobile MFC Charger Driver Race Condition Vulnerability (CVE-2021-25395) Technical Advisory
[Affected Scope] Samsung mobile devices running firmware versions prior to SMR (Security Maintenance Release) MAY-2021 Release 1
[Impact] Local attackers with compromised radio privileges can bypass signature checks via a race condition, leading to arbitrary code execution in the kernel context
[Mitigation] Apply the official Samsung security update (SMR MAY-2021 Release 1 or later) immediately and restrict unauthorized application installation
Samsung Mobile MFC Charger Driver Race Condition Use-After-Free (CVE-2021-25394) Technical Analysis and Hardening Guide
[Affected Scope] Samsung mobile devices running firmware versions prior to SMR (Samsung Security Maintenance Release) MAY-2021 Release 1.
[Impact] A local attacker with compromised radio privileges can trigger a race condition to perform an arbitrary write in kernel memory, leading to local privilege escalation (LPE).
[Mitigation] Apply the official Samsung security update (SMR MAY-2021 Release 1 or later) and restrict unauthorized local application execution.
Samsung Android sec_log Kernel Information Disclosure Vulnerability Analysis (CVE-2021-25369)
[Affected Scope] Samsung Android devices prior to SMR (Samsung Maintenance Release) March 2021 Release 1
[Impact] Local attackers can bypass critical kernel protections like KASLR by reading sensitive kernel memory addresses and structures from the improperly secured sec_log file
[Mitigation] Apply the official Samsung SMR March 2021 Release 1 (or later) firmware update immediately, or restrict access permissions to the debug log node
Samsung Mobile Devices Clipboard Service Privilege Escalation and Arbitrary File Read/Write Vulnerability (CVE-2021-25337) Analysis & Mitigation Guide
[Affected Scope] Samsung mobile devices running software versions prior to SMR (Samsung Security Maintenance Release) Mar-2021 Release 1
[Impact] Untrusted local applications can bypass sandbox boundaries to read or write sensitive local files, potentially leading to data theft or privilege escalation
[Mitigation] Immediately apply the official Samsung security update (SMR Mar-2021 Release 1 or later)
Google Chrome for Android UI Heap Buffer Overflow Sandbox Escape Vulnerability (CVE-2020-16010) Technical Advisory
[Affected Scope] Google Chrome for Android prior to version 86.0.4240.185
[Impact] A remote attacker who has compromised the renderer process can trigger a heap buffer overflow in the UI component via a crafted HTML page, potentially leading to a complete sandbox escape and arbitrary code execution on the target device
[Mitigation] Immediately update Google Chrome for Android to version 86.0.4240.185 or later via the Google Play Store
MediaTek Command Queue Driver Out-of-Bounds Write Local Privilege Escalation (CVE-2020-0069)
[Affected Scope] Android mobile devices powered by MediaTek chipsets running vulnerable kernel versions prior to the March 2020 patch level
[Impact] A local attacker can exploit this vulnerability to gain root privileges and achieve full system compromise without any user interaction
[Mitigation] Apply the March 2020 (or later) Android security patch, or restrict access permissions to the vulnerable '/dev/mtk_cmdq' device node
Android Kernel Binder Driver Out-of-Bounds Write Local Privilege Escalation (CVE-2020-0041)
[Affected Scope] Mobile devices and embedded systems running vulnerable Android Kernel versions
[Impact] A local attacker can perform an out-of-bounds write in kernel memory without any user interaction, leading to full local privilege escalation (LPE) to root
[Mitigation] Apply the Android March 2020 Security Bulletin updates or merge the corresponding upstream kernel patches
Android and Linux Kernel Binder Driver Use-After-Free Local Privilege Escalation (CVE-2019-2215)
[Affected Scope] Android OS and specific Linux kernel versions utilizing the Binder IPC driver (binder.c)
[Impact] Local attackers can execute malicious applications or chain with other vulnerabilities to gain root privileges and fully compromise the system
[Mitigation] Apply official security patches and upgrade the kernel to the latest secure version immediately
Qualcomm MSM Audio Driver Stack-Based Buffer Overflow (CVE-2013-2597) Technical Advisory
[Affected Scope] Android devices powered by Qualcomm MSM chipsets running Linux kernel versions 2.6.x and 3.x
[Impact] Local attackers can exploit the /dev/msm_acdb device node to trigger a stack-based buffer overflow, leading to local privilege escalation (LPE) to root
[Mitigation] Apply official kernel patches from Qualcomm/Google, or restrict access permissions to the vulnerable /dev/msm_acdb device node
Linux Kernel ARM Platform get_user/put_user Missing Address Validation Arbitrary Kernel Memory Read/Write and Privilege Escalation (CVE-2013-6282)
[Affected Scope] Linux kernel before version 3.5.5 running on v6k and v7 ARM platforms, including affected Android devices
[Impact] Local attackers can exploit missing address validation in get_user and put_user APIs to read or write arbitrary kernel memory, leading to full root privilege escalation
[Mitigation] Upgrade the Linux kernel to version 3.5.5 or higher, or apply the latest security patches provided by your OS/device vendor
Linux Kernel fb_mmap Integer Overflow Local Privilege Escalation Vulnerability (CVE-2013-2596)
[Affected Scope] Linux kernel versions before 3.8.9, including certain Android 4.1.2 builds and embedded Linux systems
[Impact] Local attackers can exploit an integer overflow to map the entire kernel memory space with read-write permissions, leading to full root privilege escalation
[Mitigation] Upgrade the Linux kernel to version 3.8.9 or higher, and restrict access permissions to framebuffer device files
Android vold Daemon Signed Integer Validation Vulnerability Leading to Local Privilege Escalation (CVE-2011-1823, Gingerbreak)
[Affected Scope] Android OS 3.0 and 2.x versions prior to 2.3.4
[Impact] Local attackers can execute arbitrary code and escalate privileges to root by sending crafted netlink messages
[Mitigation] Upgrade the Android operating system to version 2.3.4 or later, or apply the official vendor security patches