Lucene search

Google_androidCVELIST:CVE-2023-21358

HistoryOct 30, 2023 - 4:56 p.m.

CVE-2023-21358

2023-10-3016:56:38

google_android

www.cve.org

cve-2023-21358

malicious app

system app

improperly used crypto

local escalation of privilege

user interaction

8.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

In UWB Google, there is a possible way for a malicious app to masquerade as system app com.android.uwb.resources due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CNA Affected

[
  {
    "vendor": "Google",
    "product": "Android",
    "versions": [
      {
        "version": "14",
        "status": "affected"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

source.android.com/docs/security/bulletin/android-14