Vulnerabilities

A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it.

The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized access to an `std::unordered_map`.

The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method.

In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check.

In multiple locations, there is a possible denial of service due to a logic error in the code.

In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible out-of-bounds write due to improper input validation.

In multiple locations, there is a possible memory corruption due to a race condition.

In multiple locations, there is a possible use-after-free due to a logic error in the code.

In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition.

In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition.

In InputDispatcher::flushSensor of InputDispatcher.cpp, there is a possible denial of service due to a logic error in the code.

In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy.

In multiple functions of MediaProvider.java, there is a possible permission bypass due to a logic error in the code.

In multiple locations, there is a possible denial of service due to improper input validation.

In removeUserData of DevicePolicyManagerService.java, there is a possible denial of service due to a race condition.

In sendAnomalyProfile of ProfilingService.java, there is a possible path traversal issue due to path traversal.

In multiple locations, there is a possible permission bypass due to a confused deputy.

In multiple locations, there is a possible out-of-bounds write due to an integer overflow.

In checkLastKnownCellIdAccessPermission of TelephonyPermissions.java, there is a possible permission bypass due to a missing permission check.

In multiple locations, there is a possible permission bypass due to a logic error in the code.

In deserialize of legacy.rs, there is a possible denial of service due to a missing bounds check.

In setApplicationRestrictions of DevicePolicyManagerService.java, there is a possible denial of service due to resource exhaustion.

In decode_packed_entry_number of codebook.c, there is a possible out-of-bounds read due to a logic error in the code.

In getTouchOcclusionMode of WindowState.java, there is a possible tapjacking issue due to a tapjacking/overlay attack.

In insertInternal of MmsProvider.java, there is a possible multiuser isolation issue due to a missing permission check.