CVE-2023-20623 — Time-of-check Time-of-use (TOCTOU) Race Condition in Google Android

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition4 documents4 sources
Severity
6.4MEDIUMNVD
EPSS
0.0%
top 90.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Google AndroidYoctoproject Yocto
Timeline
PublishedMar 7

Description

In ion, there is a possible escalation of privilege due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07559778; Issue ID: ALPS07559778.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.5 | Impact: 5.9

Affected Packages3 packages

▶NVDgoogle/android10.0, 11.0, 12.0+2
▶NVDyoctoproject/yocto3.1, 3.3, 4.0+2

🔴Vulnerability Details

2
GHSA
GHSA-qh5h-hjqr-259w: In ion, there is a possible escalation of privilege due to improper locking↗2023-03-07
▶
OSV
CVE-2023-20623: In ion, there is a possible escalation of privilege due to improper locking↗2023-03-01
▶

📋Vendor Advisories

1
Android
CVE-2023-20623: ion↗2023-03-01
▶