frameworks_base_AOSP10_r33_CVE-2023-20963

This repository does not have a README...

BadParcel

BadParcel See Bundle Fengshui for a deep dive on this bug class. This repository contains PoC for CVE-2023-20963, which is mismatch in the Android WorkSource parcel/unparcel logic. The vulnerability is patched on Android's Security Bulletin of March 2023. The exploit should work on devices on AOS...

CVE-2023-20963

creationtimestamp| type| source ---|---|--- 2023-03-24 23:47:39+00:00| seen| https://t.me/cibsecurity/60683 2023-06-03 04:34:41+00:00| exploited| Telegram/r9pSH-zaZzJ85yrAwBqJG-jTD9RHKE8OIhFvQLWl5Z4 2023-06-10 08:57:29+00:00| exploited| https://t.me/androidMalware/1912 2023-06-12 11:13:38+00:00|...

CVE-2023-20963

In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-220302519...

CVE-2023-20963

CVE-2023-20963 affects Android WorkSource: a parcel/unparcel mismatch can enable local privilege escalation with no additional execution privileges required. Affected versions include Android 11–13 (11, 12, 12L, 13); patch information is in the March 2023 Android Security Bulletin, with mitigatio...