Security Bulletin

Summary
  • Security CVES
  • High CVE-2024-39432,CVE-2024-39431
  • Medium CVE-2024-39435,CVE-2024-39434,CVE-2024-39433
Minutia
  • CVE ID CVE-2024-39435
  • Title Improper Neutralization of Special Elements used in a Command ('Command Injection') in Logmanager service
  • Description

    In Logmanager service, there is a possible missing verification incorrect input. This could lead to local escalation of privilege with no additional execution privileges needed.

  • Technology Area Android
  • Vulnerability Type CWE-77 Improper Neutralization of Special Elements used in a Com
  • Access Vector Local
  • CVSS Rating Medium
  • CVSS Score 6.5
  • CVSS String CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
  • Affected Chipsets*

    SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000

  • CVE ID CVE-2024-39434
  • Title Out-of-bounds Read in drm service
  • Description

    In drm service, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.

  • Technology Area Android
  • Vulnerability Type CWE-125 Out-of-bounds Read
  • Access Vector Local
  • CVSS Rating Medium
  • CVSS Score 6.2
  • CVSS String CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • Affected Chipsets*

    T606/T612/T616/T610/T618/T760/T770/T820/S8000

  • CVE ID CVE-2024-39433
  • Title Out-of-bounds Write in drm service
  • Description

    In drm service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.

  • Technology Area Android
  • Vulnerability Type CWE-787 Out-of-bounds Write
  • Access Vector Local
  • CVSS Rating Medium
  • CVSS Score 6.2
  • CVSS String CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • Affected Chipsets*

    T606/T612/T616/T610/T618/T760/T770/T820/S8000

  • CVE ID CVE-2024-39432
  • Title Stack-based Buffer Overflow in UMTS RLC driver
  • Description

    In UMTS RLC driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with System execution privileges needed.

  • Technology Area Modem
  • Vulnerability Type CWE-121 Stack-based Buffer Overflow
  • Access Vector Adjacent
  • CVSS Rating High
  • CVSS Score 8.3
  • CVSS String CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
  • Affected Chipsets*

    SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000

  • CVE ID CVE-2024-39431
  • Title Stack-based Buffer Overflow in UMTS RLC driver
  • Description

    In UMTS RLC driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with System execution privileges needed.

  • Technology Area Modem
  • Vulnerability Type CWE-121 Stack-based Buffer Overflow
  • Access Vector Adjacent
  • CVSS Rating High
  • CVSS Score 8.3
  • CVSS String CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
  • Affected Chipsets*

    SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000

*The list of affected chipsets may not be complete. For latest information, device OEMs can contact directly at https://unisupport.unisoc.com

Vulnerability type definition
  • Abbreviation Interpretation
  • RCE Remote Code Execution
  • EoP Elevation of Privilege
  • ID Information Disclosure
  • DoS Denial of Service
  • N/A Classification not available
Version
  • Version Date Description
  • 1.0 2024-09-01