Lucene search

K
osvGoogleOSV:ASB-A-239701237
HistoryDec 01, 2022 - 12:00 a.m.

Overwrite/Delete arbitrary files with system permissions via DevicePolicyManager#setApplicationRestrictions

2022-12-0100:00:00
Google
osv.dev
7
devicepolicymanager
path traversal error
usermanagerservice
local denial of service
system execution privileges
user interaction

CVSS3

4.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

AI Score

6.6

Confidence

High

EPSS

0

Percentile

9.9%

In writeApplicationRestrictionsLAr of UserManagerService.java, there is a possible overwrite of system files due to a path traversal error. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation.

CVSS3

4.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

AI Score

6.6

Confidence

High

EPSS

0

Percentile

9.9%

Related for OSV:ASB-A-239701237