Baozeng Ding

**Name of the Vulnerable Software and Affected Versions** Android kernel **Description** The issue is related to an elevation of privilege vulnerability in the Qualcomm QCE driver. It affects the Android product. **Recommendations** For Android kernel, apply the fix referenced by Android ID: A-36591162 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Qualcomm products with Android releases from CAF using the Linux kernel (affected versions not specified) **Description** The issue is related to an incorrect bounds check in an ISP Camera kernel driver function, which may potentially lead to an out-of-bounds write. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Android kernel **Description** The issue is related to insufficient access control in the MediaTek teei component of the Android operating system. It allows a remote attacker to elevate their privileges. **Recommendations** For Android kernel, apply the fix referenced by Android ID: A-37683975 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Android kernel **Description** The issue is related to an elevation of privilege vulnerability in the MediaTek auxadc driver, which is associated with inadequate access control. This could allow a remote attacker to elevate their privileges. **Recommendations** For Android kernel, consider restricting access to the MediaTek auxadc driver until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Android kernel **Description** The issue is related to a lack of access control in the MediaTek kernel of the Android operating system, which can be exploited by a remote attacker to elevate their privileges. **Recommendations** For Android kernel, consider applying security patches or updates to fix the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Android kernel **Description** A elevation of privilege issue exists in the MediaTek gpu driver. **Recommendations** For Android kernel, apply the fix referenced by Android ID: A-32458601 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Android kernel **Description** The issue is related to a elevation of privilege vulnerability in the MediaTek networking driver, which is associated with inadequate access control. This could allow a remote attacker to elevate their privileges. **Recommendations** For Android kernel, apply the necessary patches or updates to fix the elevation of privilege vulnerability in the MediaTek networking driver. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Android (affected versions not specified) **Description** The issue is related to an elevation of privilege vulnerability in MediaTek components, including the M4U driver, sound driver, touchscreen driver, GPU driver, and Command Queue driver. This could enable a local malicious application to execute arbitrary code within the context of the kernel, potentially leading to a local permanent device compromise. The vulnerability is rated as Critical and may require reflashing the operating system to repair the device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.8.14 **Description** A race condition exists in the L2TPv3 IP Encapsulation feature, allowing local users to gain privileges or cause a denial of service. This issue is related to the net/l2tp/l2tp ip.c and net/l2tp/l2tp ip6.c files. The problem occurs when multiple bind system calls are made without properly checking whether a socket has the SOCK ZAPPED status, resulting in a use-after-free condition. **Recommendations** For Linux kernel versions prior to 4.8.14, update to version 4.8.14 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.6.3 **Description** A race condition exists in the netlink dump function, allowing local users to cause a denial of service or possibly have other unspecified impacts by making sendmsg system calls with a crafted application. This leads to a double free operation associated with a new dump that started earlier than anticipated. **Recommendations** For Linux kernel versions prior to 4.6.3, update to version 4.6.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the netlink dump function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.7 **Description** The issue is related to the tipc nl publ dump function in the Linux kernel, which does not verify socket existence. This allows local users to cause a denial of service, resulting in a NULL pointer dereference and system crash, or possibly have other unspecified impacts via a dumpit operation. **Recommendations** For Linux kernel versions prior to 4.7, update to version 4.7 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.5.2 **Description** A use-after-free issue exists, allowing local users to cause a denial of service, potentially resulting in memory corruption, system crash, or spinlock. This issue is related to the removal of a network namespace and involves the (ppp register net channel) and (ppp unregister channel) functions. **Recommendations** For versions prior to 4.5.2, update to version 4.5.2 or later to resolve the issue. As a temporary workaround, consider restricting the removal of network namespaces to minimize the risk of exploitation.