Baozeng Ding

The issue is related to an elevation of privilege vulnerability in the Qualcomm QCE driver. It affects the Android product.

The issue is related to an incorrect bounds check in an ISP Camera kernel driver function, which may potentially lead to an out-of-bounds write.

The issue is related to insufficient access control in the MediaTek teei component of the Android operating system. It allows a remote attacker to elevate their privileges.

The issue is related to an elevation of privilege vulnerability in the MediaTek auxadc driver, which is associated with inadequate access control. This could allow a remote attacker to elevate their privileges.

The issue is related to a lack of access control in the MediaTek kernel of the Android operating system, which can be exploited by a remote attacker to elevate their privileges.

A elevation of privilege issue exists in the MediaTek gpu driver.

The issue is related to a elevation of privilege vulnerability in the MediaTek networking driver, which is associated with inadequate access control. This could allow a remote attacker to elevate their privileges.

The issue is related to an elevation of privilege vulnerability in MediaTek components, including the M4U driver, sound driver, touchscreen driver, GPU driver, and Command Queue driver. This could enable a local malicious application to execute arbitrary code within the context of the kernel, potentially leading to a local permanent device compromise. The vulnerability is rated as Critical and may require reflashing the operating system to repair the device.

A race condition exists in the L2TPv3 IP Encapsulation feature, allowing local users to gain privileges or cause a denial of service. This issue is related to the net/l2tp/l2tp ip.c and net/l2tp/l2tp ip6.c files. The problem occurs when multiple bind system calls are made without properly checking whether a socket has the SOCK ZAPPED status, resulting in a use-after-free condition.

A race condition exists in the netlink dump function, allowing local users to cause a denial of service or possibly have other unspecified impacts by making sendmsg system calls with a crafted application. This leads to a double free operation associated with a new dump that started earlier than anticipated.

The issue is related to the tipc nl publ dump function in the Linux kernel, which does not verify socket existence. This allows local users to cause a denial of service, resulting in a NULL pointer dereference and system crash, or possibly have other unspecified impacts via a dumpit operation.

A use-after-free issue exists, allowing local users to cause a denial of service, potentially resulting in memory corruption, system crash, or spinlock. This issue is related to the removal of a network namespace and involves the (ppp register net channel) and (ppp unregister channel) functions.