Yonggang Guo

Name of the Vulnerable Software and Affected Versions: Huawei Mate 9 Pro smartphones with software of LON-AL00BC00B139D, LON-AL00BC00B229, LON-L29DC721B188 Description: The issue is related to a memory double free vulnerability, where the system fails to manage memory properly, leading to the freeing of the same memory address twice. An attacker could trick a user with root privilege into installing a crafted application, potentially resulting in malicious code execution. Recommendations: For LON-AL00BC00B139D, update the software to a version that properly manages memory allocation to prevent double free vulnerabilities. For LON-AL00BC00B229, apply a patch that corrects the memory management issue to prevent exploitation. For LON-L29DC721B188, restrict the installation of crafted applications until a software update that fixes the memory double free issue is available.

Name of the Vulnerable Software and Affected Versions: Huawei P9 smartphones versions prior to EVA-AL10C00B399SP02 Description: The issue is related to an information disclosure problem where the software fails to properly protect certain resources, making them accessible through multithreading. An attacker can exploit this by tricking a user with root privileges into installing a crafted application, potentially leading to kernel information disclosure. Recommendations: For versions prior to EVA-AL10C00B399SP02, update to a version that includes the necessary security patches to resolve the information disclosure issue.

Name of the Vulnerable Software and Affected Versions: Huawei smartphones Vicky-AL00AC00B124D, Vicky-AL00AC00B157D, Vicky-AL00AC00B167 Description: The issue is related to a double free vulnerability in the Flp Driver of certain Huawei smartphones. An attacker can exploit this by tricking a user into installing a malicious application with high privileges. Successful exploitation may result in a denial of service (DoS) attack. Recommendations: For Vicky-AL00AC00B124D, Vicky-AL00AC00B157D, Vicky-AL00AC00B167, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to a denial of service (DoS) vulnerability in the audio driver. An attacker can exploit this by tricking a user into installing a malicious application, which causes a race condition. This condition leads to a null pointer access during the application's access to shared resources, resulting in a system reboot.

The issue is related to a memory double free vulnerability in the soundtrigger driver. An attacker can exploit this by tricking a user into installing a malicious application, which can then start multiple threads and attempt to free specific memory. This could trigger a double free condition, leading to a system crash or potentially allowing arbitrary code execution.

The issue concerns a memory double free vulnerability in the Touch Panel driver. An attacker with root privilege of the Android system can trick a user into installing a malicious application. This application can start multiple threads and attempt to free specific memory, potentially triggering a double free condition. This could lead to a system crash or allow for arbitrary code execution.

The issue is related to a use after free (UAF) vulnerability in the Trusted Execution Environment (TEE) module driver. An attacker can exploit this by tricking a user into installing a malicious application. This application can create multiple threads and attempt to allocate and free specific memory, potentially triggering access to memory after it has been freed. This could lead to a system crash or allow for arbitrary code execution.

The issue is related to a use after free (UAF) vulnerability in the Madapt Driver of some Huawei smart phones. An attacker can exploit this vulnerability by tricking a user into installing a malicious application with high privilege. Successful exploitation may cause arbitrary code execution.

The issue is related to an elevation of privilege vulnerability in the Qualcomm ipa driver. It affects Android products.

The issue is related to an elevation of privilege vulnerability in the Upstream Linux linux kernel, affecting the Android product.

The issue allows local users to gain privileges by leveraging a race condition between a read operation and a store operation that involve different overrides in the driver override implementation in drivers/base/platform.c.

A race condition exists in a video driver of the Android operating system, potentially leading to a use-after-free condition. This issue is related to the use of memory after it has been freed. The exploitation of this issue may allow a remote attacker to cause a denial of service.

The issue is related to incorrect error handling in the set mempolicy and mbind compat syscalls in mm/mempolicy.c. This allows local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation.

A remote denial of service issue in libskia could allow an attacker to use a specially crafted file to cause a device hang or reboot. This issue is related to inadequate access control in the libskia service of the Android operating system. The exploitation of this issue may enable a remote attacker to cause device hang or reboot using a specially crafted file.

An elevation of privilege issue in the kernel ION subsystem could allow a local malicious application to execute arbitrary code within the context of the kernel, potentially leading to a local permanent device compromise. This may require reflashing the operating system to repair the device. The issue is related to insufficient access control in the ION subsystem.

The issue is related to a NULL pointer dereference error in the Qualcomm Avtimer driver, which can lead to information disclosure. A local malicious user could exploit this to obtain sensitive information.