Lucene search

GoogleOSV:ASB-A-268724205

HistoryDec 01, 2023 - 12:00 a.m.

Record audio foreground requirement permissions bypass

2023-12-0100:00:00

Google

osv.dev

oprecordaudiomonitor

missing flag

local escalation

privilege

user execution

exploitation

software

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.1 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

In OpRecordAudioMonitor::onFirstRef of AudioRecordClient.cpp, there is a possible way to record audio from the background due to a missing flag. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

CPENameOperatorVersion
platform/frameworks/nativeeq12L
platform/frameworks/aveq11
platform/frameworks/baseeq11
platform/frameworks/nativeeq11
platform/frameworks/baseeq13
platform/frameworks/aveq14
platform/frameworks/nativeeq12
platform/frameworks/aveq12L
platform/frameworks/nativeeq14
platform/frameworks/baseeq12L

Name	Operator	Version
platform/frameworks/native	eq	12L
platform/frameworks/av	eq	11
platform/frameworks/base	eq	11
platform/frameworks/native	eq	11
platform/frameworks/base	eq	13
platform/frameworks/av	eq	14
platform/frameworks/native	eq	12
platform/frameworks/av	eq	12L
platform/frameworks/native	eq	14
platform/frameworks/base	eq	12L

Rows per page:

1-10 of 151

References

android.googlesource.com/platform/frameworks/av/+/148aeea373febc959c429f2cabd8323508c38ad8

android.googlesource.com/platform/frameworks/av/+/5f401fc9f214789d691798620fea60015962370a

android.googlesource.com/platform/frameworks/base/+/b0f6558fb36eb76df35c516ec5a65030a34a8734

android.googlesource.com/platform/frameworks/native/+/9ddecd3d2b88de5ff7aa890d7ba9967c30d8b183

source.android.com/security/bulletin/2023-12-01

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.1 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for OSV:ASB-A-268724205