CVE-2023-40106

2024-02-1522:31:15

google_android

github.com

notificationmanagerservice

sanitizesbn

local privilege escalation

bal bypass

exploitation

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

In sanitizeSbn of NotificationManagerService.java, there is a possible way to launch an activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*"
    ],
    "vendor": "google",
    "product": "android",
    "versions": [
      {
        "status": "affected",
        "version": "14.0"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*"
    ],
    "vendor": "google",
    "product": "android",
    "versions": [
      {
        "status": "affected",
        "version": "13.0"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:o:google:android:12.0l:*:*:*:*:*:*:*"
    ],
    "vendor": "google",
    "product": "android",
    "versions": [
      {
        "status": "affected",
        "version": "12.0l"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*"
    ],
    "vendor": "google",
    "product": "android",
    "versions": [
      {
        "status": "affected",
        "version": "12.0"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*"
    ],
    "vendor": "google",
    "product": "android",
    "versions": [
      {
        "status": "affected",
        "version": "11.0"
      }
    ],
    "defaultStatus": "unknown"
  }
]