CVE-2023-20911

Published Mar 24, 2023

Last updated 2 years ago

Overview

Description: In addPermission of PermissionManagerServiceImpl.java , there is a possible failure to persist permission settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-242537498
Source: security@android.com
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-400

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "109DD7FD-3A48-4C3D-8E1A-4433B98E1E64"
          },
          {
            "criteria": "cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F8FB8EE9-FC56-4D5E-AE55-A5967634740C"
          },
          {
            "criteria": "cpe:2.3:o:google:android:12.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C64C1583-CDE0-4C1F-BDE6-05643C1BDD72"
          },
          {
            "criteria": "cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "879FFD0C-9B38-4CAA-B057-1086D794D469"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.1

Weaknesses

Configurations

References