New Project Zero issue:

is_compat flag in adsprpc driver leads to access of userland provided addresses as kernel pointers

https://project-zero.issues.chromium.org/issues/42451710

CVE-2024-21455

New Project Zero issue:

PowerVR: DEVMEMXINT_RESERVATION::ppsPMR references PMRs but does not lock their physical addresses

https://project-zero.issues.chromium.org/issues/42451698

CVE-2024-34747

It seems Google is still in the process of migrating issues to the new P0 issue tracker, resulting in bumping old reports to the top.

Now the bot implements a filter that won't post issues with CVE's earlier than 2023.

New Project Zero issue:

Windows: VHDMP ZwDeleteFile Arbitrary File Deletion EoP

https://project-zero.issues.chromium.org/issues/42452442

CVE-2016-7225

New Project Zero issue:

Flash: integer overflow / memory corruption with excessive number of shader input channels

https://project-zero.issues.chromium.org/issues/42451806

CVE-2015-3104

New Project Zero issue:

Flash: out-of-bounds write in ShaderParameter resolution

https://project-zero.issues.chromium.org/issues/42451807

CVE-2015-3105

New Project Zero issue:

FaceTime: Memory Corruption in VCPDecompressionDecodeFrame

https://project-zero.issues.chromium.org/issues/42450697

CVE-2018-4366

New Project Zero issue:

Qualcomm Adreno GPU ringbuffer corruption and protected mode bypass

https://project-zero.issues.chromium.org/issues/42451155

CVE-2020-11179

The Project Zero issue tracker moved to another platform *checks notes* one week after the bot started, so there will be some downtime until we adjust.

Stay tuned!

https://project-zero.issues.chromium.org/issues

New Project Zero issue:

Qualcomm KGSL: reclaimed / in-reclaim objects can still be mapped into VBOs

https://bugs.chromium.org/p/project-zero/issues/detail?id=2548

CVE-2024-23384

New Project Zero issue:

PowerVR: DevmemIntChangeSparse2() UAF on PMRGetUID() call

https://bugs.chromium.org/p/project-zero/issues/detail?id=2555

CVE-2024-40671

New Project Zero issue:

Linux: LSM can prevent POSIX lock removal in fcntl/close race cleanup path

https://bugs.chromium.org/p/project-zero/issues/detail?id=2563

CVE-2024-41012,CVE-2024-41020

New Project Zero issue:

PowerVR: out-of-bounds write of firmware addresses in PVRSRVRGXKickTA3DKM()

https://bugs.chromium.org/p/project-zero/issues/detail?id=2535

CVE-2024-31336

New Project Zero issue:

PowerVR: Driver doesn't sanitize ZS-Buffer / MSAA scratch firmware addresses

https://bugs.chromium.org/p/project-zero/issues/detail?id=2536

CVE-2024-31337

New Project Zero issue:

PowerVR: DevmemXIntMapPages() allows mapping sDevZeroPage/sDummyPage without holding reference

https://bugs.chromium.org/p/project-zero/issues/detail?id=2538

CVE-2024-31334

New Project Zero issue:

PowerVR: PMR physical memory is freed before GPU TLB invalidation

https://bugs.chromium.org/p/project-zero/issues/detail?id=2540

CVE-2024-34732

New Project Zero issue:

PowerVR: integer overflows in DevmemXIntMapPages() and DevmemXIntUnmapPages(), exploitable as dangling GPU page table entries

https://bugs.chromium.org/p/project-zero/issues/detail?id=2543

CVE-2024-34733

New Project Zero issue:

PowerVR: wrapping addition in _DevmemXReservationPageAddress() causes MMU operation at wrong address

https://bugs.chromium.org/p/project-zero/issues/detail?id=2544

CVE-2024-34748

New Project Zero issue:

Telegram for Android: Use-after-free in Connection::onReceivedData

https://bugs.chromium.org/p/project-zero/issues/detail?id=2547

New Project Zero issue:

PowerVR: two security issues identified during patch review

https://bugs.chromium.org/p/project-zero/issues/detail?id=2561

CVE-2024-40670