Lucene search

[email protected]NVD:CVE-2023-21178

HistoryJun 28, 2023 - 6:15 p.m.

CVE-2023-21178

2023-06-2818:15:14

CWE-362

[email protected]

web.nvd.nist.gov

android

race condition

keyutil.cpp

file encryption

local info disclosure

system execution privileges

no user interaction

CVSS3

4.1

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

AI Score

Confidence

High

EPSS

Percentile

5.1%

JSON

In installKey of KeyUtil.cpp, there is a possible failure of file encryption due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-140762419

Affected configurations

Nvd

Node

googleandroidMatch13.0

VendorProductVersionCPE
googleandroid13.0cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
google	android	13.0	cpe:2.3:o:google:android:13.0:::::::*

References

source.android.com/security/bulletin/pixel/2023-06-01

CVSS3

4.1

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

AI Score

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for NVD:CVE-2023-21178

cvelist1 prion1 cve1