CVE-2023-20971

🗓️ 24 Mar 2023 00:00:00Reported by google_androidType

In updatePermissionTreeSourcePackage of PermissionManagerServiceImpl.java, there is a possible way to obtain dangerous permissions without user consent due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed

Reporter	Title	Published	Views	Family All 13
Android Security Bulletins	Android Security Bulletin—August 2024Stay organized with collectionsSave and categorize content based on your preferences.	5 Aug 202400:00	–	androidsecurity
Android Security Bulletins	Pixel Update Bulletin—June 2023Stay organized with collectionsSave and categorize content based on your preferences.	13 Jun 202300:00	–	androidsecurity
Circl	CVE-2023-20971	10 Aug 202411:30	–	circl
CNNVD	Google Pixel 安全漏洞	24 Mar 202300:00	–	cnnvd
Cvelist	CVE-2023-20971	24 Mar 202300:00	–	cvelist
NCSC	Vulnerabilities fixed in Google Android and Samsung Mobile	6 Aug 202409:25	–	ncsc
NVD	CVE-2023-20971	24 Mar 202320:15	–	nvd
OSV	ASB-A-225880325	1 Aug 202400:00	–	osv
OSV	PUB-A-225880325	1 Jun 202300:00	–	osv
Prion	Code injection	24 Mar 202320:15	–	prion

NVD

Vulners

Node

google androidMatch13.0

[
  {
    "vendor": "Google",
    "product": "Android",
    "versions": [
      {
        "version": "14",
        "status": "affected"
      },
      {
        "version": "13",
        "status": "affected"
      },
      {
        "version": "12L",
        "status": "affected"
      },
      {
        "version": "12",
        "status": "affected"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
source	www.source.android.com/security/bulletin/2024-08-01
android	www.android.googlesource.com/platform/frameworks/base/+/6c22d6c1e69676c5c68d21928aa5486bfd1bd131
source	www.source.android.com/security/bulletin/pixel/2023-06-01

25 Feb 2025 16:15Current

7.7High risk

Vulners AI Score7.7

CVSS 3.17.8

EPSS0.00016

SSVC

CWE-863