Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2021-0735
In PackageManager, there is a possible way to get information about installed packages ignoring limitations introduced in Android 11 due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-188913056
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/android-13'}]
CVE State: PUBLISHED
Explain CVE-2021-0769
In onCreate of AllowBindAppWidgetActivity.java, there is a possible bypass of user interaction requirements due to unclear UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-184676316
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/pixel/2021-12-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0799
In ActivityThread.java, there is a possible way to collide the content provider's authorities. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-197647956
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-11-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0869
In GetTimeStampAndPkt of DumpstateDevice.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-179620905 References: N/A
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/pixel/2021-09-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0870
In RW_SetActivatedTagType of rw_main.cc, there is possible memory corruption due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-192472262
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-10-01'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/164704/Android-NFC-Type-Confusion.html'}]
CVE State: PUBLISHED
Explain CVE-2021-0871
In PVRSRVBridgePMRPDumpSymbolicAddr of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap access. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-238921253
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2022-09-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0872
In PVRSRVBridgeRGXKickVRDM of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap access. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-270401229
Affected Products: Android
References: [{'url': 'https://source.android.com/security/bulletin/2023-04-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0873
In PVRSRVBridgeRGXKickRS of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap access. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-270392711
Affected Products: Android
References: [{'url': 'https://source.android.com/security/bulletin/2023-04-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0874
In PVRSRVBridgeDevicememHistorySparseChange of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap access. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-270399633
Affected Products: Android
References: [{'url': 'https://source.android.com/security/bulletin/2023-04-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0875
In PVRSRVBridgeChangeSparseMem of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap access. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-270400061
Affected Products: Android
References: [{'url': 'https://source.android.com/security/bulletin/2023-04-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0876
In PVRSRVBridgePhysmemNewRamBackedLockedPMR of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap access. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-270400229
Affected Products: Android
References: [{'url': 'https://source.android.com/security/bulletin/2023-04-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0878
In PVRSRVBridgeServerSyncGetStatus of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap access. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-270399153
Affected Products: Android
References: [{'url': 'https://source.android.com/security/bulletin/2023-04-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0879
In PVRSRVBridgeRGXTDMSubmitTransfer of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap access. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-270397970
Affected Products: Android
References: [{'url': 'https://source.android.com/security/bulletin/2023-04-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0880
In PVRSRVBridgeRGXKickTA3D of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap access. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-270396792
Affected Products: Android
References: [{'url': 'https://source.android.com/security/bulletin/2023-04-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0881
In PVRSRVBridgeRGXKickCDM of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap access. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-270396350
Affected Products: Android
References: [{'url': 'https://source.android.com/security/bulletin/2023-04-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0882
In PVRSRVBridgeRGXKickSync of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap access. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-270395803
Affected Products: Android
References: [{'url': 'https://source.android.com/security/bulletin/2023-04-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0883
In PVRSRVBridgeCacheOpQueue of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap access. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-270395013
Affected Products: Android
References: [{'url': 'https://source.android.com/security/bulletin/2023-04-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0884
In PVRSRVBridgePhysmemImportSparseDmaBuf of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap access. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-270393454
Affected Products: Android
References: [{'url': 'https://source.android.com/security/bulletin/2023-04-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0885
In PVRSRVBridgeSyncPrimOpTake of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap access. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-270401914
Affected Products: Android
References: [{'url': 'https://source.android.com/security/bulletin/2023-04-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0887
In PVRSRVBridgeHeapCfgHeapConfigName, there is a possible leak of kernel heap content due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-236848817
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2022-08-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0889
In Android TV , there is a possible silent pairing due to lack of rate limiting in the pairing flow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-8.1 Android-9Android ID: A-180745296
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-11-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0891
An unprivileged app can trigger PowerVR driver to return an uninitialized heap memory causing information disclosure.Product: AndroidVersions: Android SoCAndroid ID: A-236849490
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2022-08-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0893
In apusys, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05687474.
Affected Products: MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT8195, MT8791, MT8797
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://corp.mediatek.com/product-security-bulletin/December-2021'}]
CVE State: PUBLISHED
Explain CVE-2021-0894
In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05672038.
Affected Products: MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT8195, MT8791, MT8797
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://corp.mediatek.com/product-security-bulletin/December-2021'}]
CVE State: PUBLISHED
Explain CVE-2021-0895
In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05672003.
Affected Products: MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT8195, MT8791, MT8797
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://corp.mediatek.com/product-security-bulletin/December-2021'}]
CVE State: PUBLISHED
Explain CVE-2021-0896
In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05671206.
Affected Products: MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT8195, MT8791, MT8797
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://corp.mediatek.com/product-security-bulletin/December-2021'}]
CVE State: PUBLISHED
Explain CVE-2021-0897
In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05670549.
Affected Products: MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT8195, MT8791, MT8797
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://corp.mediatek.com/product-security-bulletin/December-2021'}]
CVE State: PUBLISHED
Explain CVE-2021-0898
In apusys, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05672071.
Affected Products: MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT8195, MT8791, MT8797
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://corp.mediatek.com/product-security-bulletin/December-2021'}]
CVE State: PUBLISHED
Explain CVE-2021-0899
In apusys, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05672059.
Affected Products: MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT8195, MT8791, MT8797
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://corp.mediatek.com/product-security-bulletin/December-2021'}]
CVE State: PUBLISHED
Explain CVE-2021-0900
In apusys, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05672055.
Affected Products: MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT8195, MT8791, MT8797
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://corp.mediatek.com/product-security-bulletin/December-2021'}]
CVE State: PUBLISHED
Explain CVE-2021-0901
In apusys, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05664618.
Affected Products: MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT8195, MT8791, MT8797
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://corp.mediatek.com/product-security-bulletin/December-2021'}]
CVE State: PUBLISHED
Explain CVE-2021-0902
In apusys, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05656484.
Affected Products: MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT8195, MT8791, MT8797
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://corp.mediatek.com/product-security-bulletin/December-2021'}]
CVE State: PUBLISHED
Explain CVE-2021-0903
In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05656488.
Affected Products: MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT8195, MT8791, MT8797
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://corp.mediatek.com/product-security-bulletin/December-2021'}]
CVE State: PUBLISHED
Explain CVE-2021-0904
In SRAMROM, there is a possible permission bypass due to an insecure permission setting. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06076938; Issue ID: ALPS06076938.
Affected Products: MT6771, MT8183, MT8385, MT8788
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://corp.mediatek.com/product-security-bulletin/December-2021'}]
CVE State: PUBLISHED
Explain CVE-2021-0918
In gatt_process_notification of gatt_cl.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-197536150
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-11-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0919
In getService of IServiceManager.cpp, there is a possible unhandled exception due to an integer overflow. This could lead to local denial of service making the lockscreen unusable with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-9Android ID: A-197336441
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-11-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0920
In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-11-01'}, {'name': '[debian-lts-announce] 20211216 [SECURITY] [DLA 2843-1] linux security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html'}]
CVE State: PUBLISHED
Explain CVE-2021-0921
In ParsingPackageImpl of ParsingPackageImpl.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-195962697
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-11-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0922
In enforceCrossUserOrProfilePermission of PackageManagerService.java, there is a possible bypass of INTERACT_ACROSS_PROFILES permission due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-195630721
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-11-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0923
In createOrUpdate of Permission.java, there is a possible way to gain internal permissions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-195338390
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-11-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0924
In xhci_vendor_get_ops of xhci.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-194461020References: Upstream kernel
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-11-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0925
In rw_t4t_sm_detect_ndef of rw_t4t.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure due to a limited change in behavior based on the out of bounds data with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-191444150
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-11-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0926
In onCreate of NfcImportVCardActivity.java, there is a possible way to add a contact without user's consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-191053931
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-11-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0927
In requestChannelBrowsable of TvInputManagerService.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-8.1 Android-9Android ID: A-189824175
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-11-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0928
In createFromParcel of OutputConfiguration.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-9Android ID: A-188675581
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-11-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0929
In ion_dma_buf_end_cpu_access and related functions of ion.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-187527909References: Upstream kernel
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-11-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0930
In phNxpNciHal_process_ext_rsp of phNxpNciHal_ext.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over NFC with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-181660091
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-11-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0931
In getAlias of BluetoothDevice.java, there is a possible way to create misleading permission dialogs due to missing data filtering. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-180747689
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-11-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0932
In showNotification of NavigationModeController.java, there is a possible confused deputy due to an unsafe PendingIntent. This could lead to local escalation of privilege that allows actions performed as the System UI with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-173025705
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-11-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0933
In onCreate of CompanionDeviceActivity.java or DeviceChooserActivity.java, there is a possible way for HTML tags to interfere with a consent dialog due to improper input validation. This could lead to remote escalation of privilege, confusing the user into accepting pairing of a malicious Bluetooth device, with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-172251622
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-11-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0934
In findAllDeAccounts of AccountsDb.java, there is a possible denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-169762606
Affected Products: Android
References: [{'url': 'https://source.android.com/security/bulletin/2022-12-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0935
In ip6_xmit of ip6_output.c, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-168607263References: Upstream kernel
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/pixel/2021-10-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0936
In acc_read of f_accessory.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-173789633References: Upstream kernel
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/pixel/2021-10-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0938
In memzero_explicit of compiler-clang.h, there is a possible bypass of defense in depth due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-171418586References: Upstream kernel
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/pixel/2021-10-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0939
In set_default_passthru_cfg of passthru.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-186026549References: N/A
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/pixel/2021-10-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0940
In TBD of TBD, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-171315276References: N/A
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/pixel/2021-10-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0941
In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-154177719References: Upstream kernel
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/pixel/2021-10-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0942
The path in this case is a little bit convoluted. The end result is that via an ioctl an untrusted app can control the ui32PageIndex offset in the expression:sPA.uiAddr = page_to_phys(psOSPageArrayData->pagearray[ui32PageIndex]);With the current PoC this crashes as an OOB read. However, given that the OOB read value is ending up as the address field of a struct I think i seems plausible that this could lead to an OOB write if the attacker is able to cause the OOB read to pull an interesting kernel address. Regardless if this is a read or write, it is a High severity issue in the kernel.Product: AndroidVersions: Android SoCAndroid ID: A-238904312
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2022-09-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0943
In MMU_MapPages of TBD, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-238916921
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2022-09-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0945
In _PMRCreate of the PowerVR kernel driver, a missing bounds check means it is possible to overwrite heap memory via PhysmemNewRamBackedPMR. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Products: Android
References: [{'url': 'https://source.android.com/security/bulletin/2023-06-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0946
The method PVRSRVBridgePMRPDumpSymbolicAddr allocates puiMemspaceNameInt on the heap, fills the contents of the buffer via PMR_PDumpSymbolicAddr, and then copies the buffer to userspace. The method PMR_PDumpSymbolicAddr may fail, and if it does the buffer will be left uninitialized and despite the error will still be copied to userspace. Kernel leak of uninitialized heap data with no privs required.Product: AndroidVersions: Android SoCAndroid ID: A-236846966
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2022-08-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0947
The method PVRSRVBridgeTLDiscoverStreams allocates puiStreamsInt on the heap, fills the contents of the buffer via TLServerDiscoverStreamsKM, and then copies the buffer to userspace. The method TLServerDiscoverStreamsKM may fail for several reasons including invalid sizes. If this method fails the buffer will be left uninitialized and despite the error will still be copied to userspace. Kernel leak of uninitialized heap data with no privs required.Product: AndroidVersions: Android SoCAndroid ID: A-236838960
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2022-08-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0948
The PVRSRVBridgeGetMultiCoreInfo ioctl in the PowerVR kernel driver can return uninitialized kernel memory to user space. The contents of this memory could contain sensitive information.


Affected Products: Android
References: [{'url': 'https://source.android.com/security/bulletin/2023-07-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0951
In DevmemIntHeapAcquire of TBD, there is a possible arbitrary code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-242345085
Affected Products: Android
References: [{'url': 'https://source.android.com/security/bulletin/2022-10-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0952
In doCropPhoto of PhotoSelectionHandler.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure of user's contacts with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-195748381
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-12-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0953
In setOnClickActivityIntent of SearchWidgetProvider.java, there is a possible way to access contacts and history bookmarks without permission due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-184046278
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-12-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0954
In ResolverActivity, there is a possible user interaction bypass due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-143559931
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-12-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0955
In pf_write_buf of FuseDaemon.cpp, there is possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-192085766
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-12-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0956
In NfcTag::discoverTechnologies (activation) of NfcTag.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additionalSystem execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12Android ID: A-189942532
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-12-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0957
In NotificationStackScrollLayout of NotificationStackScrollLayout.java, there is a possible way to bypass Factory Reset Protections. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-193149550
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2022-03-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0958
In update of km_compat.cpp, there is a possible loss of potentially sensitive data due to a logic error in the code. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12Android ID: A-200041882
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-12-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0959
In jit_memory_region.cc, there is a possible bypass of memory restrictions due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-200284993
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2022-01-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0961
In quota_proc_write of xt_quota2.c, there is a possible way to read kernel memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196046570References: Upstream kernel
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-12-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0963
In onCreate of KeyChainActivity.java, there is a possible way to use an app certificate stored in keychain due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-199754277
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-12-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0964
In C2SoftMP3::process() of C2SoftMp3Dec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-193363621
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-12-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0965
In AndroidManifest.xml of Settings, there is a possible pairing of a Bluetooth device without user's consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-194300867
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-12-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0966
In code generated by BuildParcelFields of generate_cpp.cpp, there is a possible way for a crafted parcelable to reveal uninitialized memory of a target process due to uninitialized data. This could lead to local information disclosure across Binder transactions with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12Android ID: A-198346478
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-12-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0967
In vorbis_book_decodev_set of codebook.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-199065614
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-12-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0968
In osi_malloc and osi_calloc of allocator.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-197868577
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-12-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0969
In getTitle of AccessPoint.java, there is a possible unhandled exception due to a missing null check. This could lead to remote denial of service if a proximal Wi-Fi AP provides invalid information with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-199922685
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-12-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0970
In createFromParcel of GpsNavigationMessage.java, there is a possible Parcel serialization/deserialization mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-196970023
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-12-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0971
In MPEG4Source::read of MPEG4Extractor.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-188893559
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2021-12-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0973
In isFileUri of UriUtil.java, there is a possible way to bypass ignoring file://URI attachment due to improper handling of case sensitivity. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-197328178
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/pixel/2021-12-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0975
In USB Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure of installed packages with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-180104273
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/android-13'}]
CVE State: PUBLISHED
Explain CVE-2021-0976
In toBARK of floor0.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-199680600
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/pixel/2021-12-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0977
In phNxpNHal_DtaUpdate of phNxpNciHal_dta.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-183487770
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/pixel/2021-12-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0978
In getSerialForPackage of DeviceIdentifiersPolicyService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-192587406
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/pixel/2021-12-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0979
In isRequestPinItemSupported of ShortcutService.java, there is a possible cross-user leak of packages in which the default launcher supports requests to create pinned shortcuts due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-191772737
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/pixel/2021-12-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0981
In enqueueNotificationInternal of NotificationManagerService.java, there is a possible way to run a foreground service without showing a notification due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-191981182
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/2022-07-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0982
In getOrganizationNameForUser of DevicePolicyManagerService.java, there is a possible organization name disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-192368508
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/pixel/2021-12-01'}]
CVE State: PUBLISHED
Explain CVE-2021-0983
In createAdminSupportIntent of DevicePolicyManagerService.java, there is a possible disclosure of information about installed device/profile owner package name due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-192245204
Affected Products: Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://source.android.com/security/bulletin/pixel/2022-06-01'}]
CVE State: PUBLISHED