CVE-2023-20971

In removePermission of PermissionManagerServiceImpl.java, there is a possible way to obtain dangerous permissions without user consent due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://android.googlesource.com/platform/frameworks/base/+/6c22d6c1e69676c5c68d21928aa5486bfd1bd131
https://source.android.com/security/bulletin/2024-08-01
https://source.android.com/security/bulletin/pixel/2023-06-01

Configurations

Configuration 1 (hide)

cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*

History

21 Nov 2024, 07:41

Type	Values Removed	Values Added
References		() https://source.android.com/security/bulletin/pixel/2023-06-01 -

15 Aug 2024, 22:15

Type	Values Removed	Values Added
Summary	(en) In updatePermissionTreeSourcePackage of PermissionManagerServiceImpl.java, there is a possible way to obtain dangerous permissions without user consent due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-225880325	(en) In removePermission of PermissionManagerServiceImpl.java, there is a possible way to obtain dangerous permissions without user consent due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References	~~{'url': 'https://source.android.com/security/bulletin/pixel/2023-06-01', 'source': 'security@android.com'}~~	() https://android.googlesource.com/platform/frameworks/base/+/6c22d6c1e69676c5c68d21928aa5486bfd1bd131 - () https://source.android.com/security/bulletin/2024-08-01 -

28 Jun 2023, 18:15

Type	Values Removed	Values Added
References	~~{'url': 'https://source.android.com/security/bulletin/pixel/2023-03-01', 'name': 'https://source.android.com/security/bulletin/pixel/2023-03-01', 'tags': ['Vendor Advisory'], 'refsource': 'MISC'}~~	(MISC) https://source.android.com/security/bulletin/pixel/2023-06-01 -
Summary	In updatePermissionTreeSourcePackage of PermissionManagerServiceImpl.java, there is a possible way to obtain dangerous permission without the user's consent due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-225880325	In updatePermissionTreeSourcePackage of PermissionManagerServiceImpl.java, there is a possible way to obtain dangerous permissions without user consent due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-225880325

Information

Published : 2023-03-24 20:15

Updated : 2024-11-21 07:41

NVD link : CVE-2023-20971

Mitre link : CVE-2023-20971

CVE.ORG link : CVE-2023-20971

JSON object : View

Products Affected

google

android

CWE

NVD-CWE-noinfo

7.8 /10