CVE-2021-0942

Read Time:36 Second

The path in this case is a little bit convoluted. The end result is that via an ioctl an untrusted app can control the ui32PageIndex offset in the expression:sPA.uiAddr = page_to_phys(psOSPageArrayData->pagearray[ui32PageIndex]);With the current PoC this crashes as an OOB read. However, given that the OOB read value is ending up as the address field of a struct I think i seems plausible that this could lead to an OOB write if the attacker is able to cause the OOB read to pull an interesting kernel address. Regardless if this is a read or write, it is a High severity issue in the kernel.Product: AndroidVersions: Android SoCAndroid ID: A-238904312

Google Releases April Android Update to Address Two Zero-Days

NIST Defers Pre-2018 CVEs to Tackle Growing Vulnerability Backlog

Half of Firms Stall Digital Projects as Cyber Warfare Risk Surges

CISA Warns of CrushFTP Vulnerability Exploitation in the Wild

Arguing Against CALEA

Boards Urged to Follow New Cyber Code of Practice

Russian bots hard at work spreading political unrest on Romania’s internet

Malicious Microsoft VS Code Extensions Used in Cryptojacking Campaign

Smishing Triad Fuels Surge in Toll Payment Scams in US, UK

mysql8.0-8.0.41-1.fc41

mysql8.0-8.0.41-1.fc40

workrave-1.11.0~rc.1-1.el9

workrave-1.11.0~rc.1-1.fc41

workrave-1.11.0~rc.1-1.fc42

workrave-1.11.0~rc.1-1.fc40