CVE-2023-45777 (High) detected in baseandroid-10.0.0_r34
Opened this issue · 0 comments
CVE-2023-45777 - High Severity Vulnerability
Vulnerable Library - baseandroid-10.0.0_r34
Android framework classes and services
Library home page: https://android.googlesource.com/platform/frameworks/base
Found in HEAD commit: 03b43038e3cbf1172bc2f0bd826b54ca121890ab
Found in base branch: master
Vulnerable Source Files (1)
/services/core/java/com/android/server/accounts/AccountManagerService.java
Vulnerability Details
In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to launch arbitrary activities using system privileges due to Parcel Mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Publish Date: 2023-12-04
URL: CVE-2023-45777
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://android.googlesource.com/platform/frameworks/base/+/f810d81839af38ee121c446105ca67cb12992fc6
Release Date: 2023-12-04
Fix Resolution: android-14.0.0_r16
Step up your Open Source Security Game with Mend here