Amlogic Android Sdk
Monthly
Local privilege escalation to root affects the Amlogic Android SDK's pppoe_wrapper daemon as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes, where any unprivileged local process or app can send a crafted message to the world-writable AF_UNIX datagram socket at /dev/socket/pppoe_wrapper. A message beginning with 'pppd pty' and containing shell metacharacters is passed unfiltered to system(3) and executed by /system/bin/sh -c as root, giving full control of the device. Exploitation is local-only (CVSS 4.0 AV:L, independently assessed CVSS 3.1 AV:L/AC:L/PR:L/UI:N) and requires the attacker to already have local code execution; a public PoC reference exists but is not verified as working exploit code, and no CISA KEV active-exploitation entry is present.
An out-of-bounds stack write in the VobSub subtitle decoder (libsub_vob) of the Amlogic DroidLogic SubTitleService allows remote attackers to corrupt memory on Nexbox A95X (Amlogic S905X) TV boxes and other devices built from the Amlogic Android SDK. A crafted SET_CONTR command carrying an attacker-controlled alpha value drives the change_data index past the end of the fixed four-element PixelDatas array inside vob_fill_pixel(), zeroing adjacent stack bytes; the payload can arrive over the unauthenticated tcp/10100 socket or by getting the device to parse a malicious .sub file. No authentication and no user interaction are required, but the assessed impact is limited to silent stack corruption or a process crash rather than code execution, and the tcp/10100 service is typically LAN-exposed rather than internet-facing. A public PoC reference exists; it is not verified as working exploit code, and no confirmed active exploitation has been reported.
An infinite loop in the get_vob_spu() function of the libsub_vob VobSub subtitle decoder, part of Amlogic's DroidLogic SubTitleService shipped on Amlogic S905X-based devices such as the Nexbox A95X TV box, lets remote network attackers reachable on the LAN or local users loading a crafted file stall the subtitle decode thread at 100% CPU indefinitely, producing a denial of service. Two trigger paths are documented: sending a crafted AMLU data block with mismatched length fields to the unauthenticated tcp/10100 listener, or loading a malicious VobSub (.sub) file. No authentication or user interaction is required (CVSS 4.0 base 6.9 Medium; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N with availability-only low impact), and only a public PoC reference exists - it is not verified as working exploit code, and no active exploitation has been confirmed. Exposure is bounded by the fact that tcp/10100 is a local service typically reachable only from the LAN, with no confidentiality or integrity impact and no code execution.
Local privilege escalation to root affects the Amlogic Android SDK's pppoe_wrapper daemon as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes, where any unprivileged local process or app can send a crafted message to the world-writable AF_UNIX datagram socket at /dev/socket/pppoe_wrapper. A message beginning with 'pppd pty' and containing shell metacharacters is passed unfiltered to system(3) and executed by /system/bin/sh -c as root, giving full control of the device. Exploitation is local-only (CVSS 4.0 AV:L, independently assessed CVSS 3.1 AV:L/AC:L/PR:L/UI:N) and requires the attacker to already have local code execution; a public PoC reference exists but is not verified as working exploit code, and no CISA KEV active-exploitation entry is present.
An out-of-bounds stack write in the VobSub subtitle decoder (libsub_vob) of the Amlogic DroidLogic SubTitleService allows remote attackers to corrupt memory on Nexbox A95X (Amlogic S905X) TV boxes and other devices built from the Amlogic Android SDK. A crafted SET_CONTR command carrying an attacker-controlled alpha value drives the change_data index past the end of the fixed four-element PixelDatas array inside vob_fill_pixel(), zeroing adjacent stack bytes; the payload can arrive over the unauthenticated tcp/10100 socket or by getting the device to parse a malicious .sub file. No authentication and no user interaction are required, but the assessed impact is limited to silent stack corruption or a process crash rather than code execution, and the tcp/10100 service is typically LAN-exposed rather than internet-facing. A public PoC reference exists; it is not verified as working exploit code, and no confirmed active exploitation has been reported.
An infinite loop in the get_vob_spu() function of the libsub_vob VobSub subtitle decoder, part of Amlogic's DroidLogic SubTitleService shipped on Amlogic S905X-based devices such as the Nexbox A95X TV box, lets remote network attackers reachable on the LAN or local users loading a crafted file stall the subtitle decode thread at 100% CPU indefinitely, producing a denial of service. Two trigger paths are documented: sending a crafted AMLU data block with mismatched length fields to the unauthenticated tcp/10100 listener, or loading a malicious VobSub (.sub) file. No authentication or user interaction is required (CVSS 4.0 base 6.9 Medium; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N with availability-only low impact), and only a public PoC reference exists - it is not verified as working exploit code, and no active exploitation has been confirmed. Exposure is bounded by the fact that tcp/10100 is a local service typically reachable only from the LAN, with no confidentiality or integrity impact and no code execution.