Published file metadata, source observations, indicators, and research history in one bounded catalog.
2,400+Reachable catalog records
66 / 100Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
src_350d40f2cc69277bcaCollection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
Samsung’s neural processing framework has received a lot of attention from the security community since its introduction. Hardware isolation vulnerabilities have been demonstrated, both on the NPU and DSP cores (1, 2), that could be used to compromise the kernel. The surrounding kernel code was also exploited by multiple researchers to gain local privilege escalation (1, 2). I, too, explored in a
First reported Jul 30, 2021 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
Summary In this advisory we are disclosing a heap overflow vulnerability in the MediaTek baseband. The vulnerability can be exploited to gain arbitrary code execution in the context of the baseband runtime. The vulnerability was fixed in 2020 in some models, and received a CVE and more widely deployed fix in 2021. Vulnerability Details When processing the GSM Radio Resource Management Channel Rele
First reported Mar 10, 2022 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
Summary In this advisory we are disclosing a signature verification bypass vulnerability in the Huawei recovery mode. The vulnerability can be used not only to apply unauthentic firmware updates but also to achieve arbitrary code execution in the recovery mode. Combining this advisory with the vulnerability detailed in CVE-2021-40055, an attacker can achieve remote code execution without user inte
First reported May 18, 2022 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
There is a kernel virtual memory mapped IO buffer overflow vulnerability in the vision DSP kernel driver of S20 Exynos devices. The vulnerability could potentially be used by a malicious system application to compromise the kernel and gain further privileges. The vulnerability is only triggerable via compromised system applications due to a second access control bypass issue. In addition to achiev
First reported Dec 14, 2021 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
Summary Last year we published research at Black Hat in which we disclosed multiple vulnerabilities in Huawei Kirin SoC’s DDR Controller (DMSS) Access Permission system which allowed some SoC cores or DMA-capable peripherals to directly access secure world memory and completely compromise the entire memory of the SoC. This advisory focuses on a new access permission vulnerability in the same DMSS.
First reported May 18, 2022 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
Summary In this advisory we are disclosing a heap overflow vulnerability in the MediaTek baseband. The vulnerability can be exploited to gain arbitrary code execution in the context of the baseband runtime. The vulnerability was fixed in 2020 in some models, and received a CVE and more widely deployed fix in 2021. Vulnerability Details When processing the CSN.1 decoding of the “E-UTRAN Individual
First reported Mar 10, 2022 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
There is a vmalloc out of bounds write vulnerability in the vision DSP kernel driver of Samsung Exynos S20 devices. The vulnerability could potentially be used by a malicious system application to compromise the kernel and gain further privileges. Vulnerability Details The Exynos DSP driver implements two distinct ioctl calls that are used to load images and graphs and boot the device. The DSP_IOC
First reported Dec 14, 2021 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
This summer at Black Hat, we have published research about exploiting Huawei basebands (video recording also available here). The remote code execution attack surface explored in that work was the Radio Resource stack’s CSN.1 decoder. Searching for bugs in CSN.1 decoding turned out to be very fruitful in the case of Huawei’s baseband, however, they were not the only vendor that we looked at - or t
First reported Mar 10, 2022 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
There is a sensitive information disclosure vulnerability in the vision DSP kernel driver of S20 Exynos devices. The vulnerability can be used by malicious privileged applications to read the kernel’s and other application’s memory. Vulnerability Details The Exynos DSP driver implements an ioctl call that allows applications to upload a custom model (graph) for the dsp device. The DSP_IOC_LOAD_GRA
First reported Dec 14, 2021 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
We have identified a new Toc-ToU race condition vulnerability in Huawei’s recovery image implementation of SD-card based firmware updates. The vulnerability can be exploited to achieve arbitrary code execution in recovery mode, enabling unauthentic firmware updates, firmware downgrades to a known vulnerable version or other system modifications. The vulnerability we are disclosing in this advisory
First reported Feb 16, 2023 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
Summary The NPU device’s kernel driver implements a set of ioctl handlers one of which uses unsanitized user data as an index into a function pointer array. The user provided values can exceed the boundaries of the legitimate array and might cause user controlled values to be called as function pointers. A malicious actor can use this vulnerability to hijack the control flow of the kernel and call
First reported Aug 02, 2021 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
There is an ION memory buffer type confusion vulnerability in the Exynos ION kernel driver. The vulnerability can cause zero initialised memory to be treated as a valid pointer and cause a kernel NULL pointer exception. Untrusted applications can abuse this bug to cause a kernel crash and carry out DOS attacks agains the device. Vulnerability Details The vulnerable code is in ion_iovmm_map in driv
First reported Dec 13, 2021 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
Recently we have disclosed new advisories related to the remote exploitation of Huawei smartphones. The research that led to these findings was motivated by analyzing new interfaces for remote code execution on a mobile platform. After our work on exploiting Huawei’s Kirin via its baseband interface, we wanted to explore the possibilities of logic bugs as RCE vectors in a modern smartphone chipset
First reported Jun 14, 2022 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
In this advisory we are disclosing a vulnerability in the Huawei log device that allows any unprivileged process to disclose sensitive information from the kernel. Huawei kernels are shipped with custom log devices (/dev/hwlog_dubai, /dev/hwlog_exception and /dev/hwlog_jank) that facilitate better system diagnostics through a series of ioctl calls. One of these diagnostics module is referred to as
First reported Jul 24, 2022 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
Summary Last year we published research at Black Hat in which we disclosed multiple vulnerabilities in Huawei Kirin SoC’s DDR Controller (DMSS) Access Permission system which allowed some SoC cores or DMA-capable peripherals to directly access secure world memory and completely compromise the entire memory of the SoC. This advisory focuses on a new access permission vulnerability in the same DMSS.
First reported May 18, 2022 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
Summary There is a vulnerability in the Huawei Kirin SoC’s DDR Controller (DMSS) Access Permission system which allows the baseband to bypass the Baseband’s MPU memory protections and circumvent RO and NX protections. The vulnerability was fixed in February 2022. Vulnerability Details CVE-2021-22430 is a vulnerability in the Huawei Kirin SoC’s basebands which allowed to circumvent MPU restrictions
First reported May 18, 2022 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
Summary Due to a bug in the way mappings are closed it is possible to free a kmallocated memory chunk arbitrary times. This vulnerability can be used to craft a use after free scenario against any kernel structure that is allocated from the kmalloc-64 cache. There is rich public literature on how such use after free vulnerabilities can be utilized to compromise the kernel, achieve code execution i
First reported Aug 02, 2021 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
Summary During the regular boot sequence, Huawei’s BootROM initializes the UFS hardware and the crypto engine in order to load and verify the next stage bootloader image from flash. However, when run in download mode, which maybe used for factory flashing and repair purposes, a connected host can communicate with the BootROM via USB. In this case, the BootROM acts as a USB1.1 Serial-over-USB gadge
First reported Jul 30, 2021 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
Summary Last year we published research at Black Hat in which we disclosed multiple vulnerabilities in Huawei Kirin SoC’s DDR Controller (DMSS) Access Permission system which allowed some SoC cores or DMA-capable peripherals to directly access secure world memory and completely compromise the entire memory of the SoC. This advisory focuses on a new access permission vulnerability in the same DMSS.
First reported May 18, 2022 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
Summary There is a vulnerability in the Huawei Kirin SoC’s DDR Controller (DMSS) Access Permission system which allows the Linux kernel to bypass memory access restrictions and directly compromise multiple privileged subsystems of the SoC. As demonstrated by CVE-2021-3710, CVE-2021-39991, CVE-2021-37115, and CVE-2021-39986, read and write of critical system memory, including secure memory regions,
First reported May 18, 2022 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
In this advisory we are disclosing a memory corruption vulnerability in the Huawei log device that allows any unprivileged process to trigger a kernel crash and reboot the device. Huawei kernels are shipped with custom log devices (/dev/hwlog_dubai, /dev/hwlog_exception and /dev/hwlog_jank) that facilitate better system diagnostics through a series of ioctl calls. One of these diagnostics module i
First reported Jul 24, 2022 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
Summary In this advisory we are disclosing a vulnerability in the Huawei Over-The-Air (OTA) update implementation that allows bypassing SSL protections and execute a Man-In-The-Middle attack. The vulnerability was fixed in March 2022. Vulnerability Details Huawei devices - both those running Android and those running HarmonyOS - use Huawei’s custom implementation for applying OTA updates. OTA upda
First reported May 18, 2022 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.