CVE-2023-20935 — Out-of-bounds Read in Google Android

CWE-125 — Out-of-bounds Read5 documents5 sources

Severity

5.5MEDIUMNVD

EPSS

0.0%

top 92.46%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Platform Hardware Interfaces Platform Packages Modules Neuralnetworks Google Android

Timeline

PublishedApr 19

Description

In deserialize of multiple files, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-256589724

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5google/androidAndroid-11 Android-12 Android-12L Android-13

▶NVDgoogle/android4 versions+3

▶Androidplatform/hardware_interfaces13-next:0 — 13-next:2023-04-01+3

▶Androidplatform/packages_modules_neuralnetworks13-next:0 — 13-next:2023-04-01+3

🔴Vulnerability Details

CVEList

CVE-2023-20935: In deserialize of multiple files, there is a possible out of bounds read due to a missing bounds check↗2023-04-19

▶

GHSA

GHSA-3gqm-7mxg-qm6g: In deserialize of multiple files, there is a possible out of bounds read due to a missing bounds check↗2023-04-19

▶

OSV

CVE-2023-20935: In deserialize of multiple files, there is a possible out of bounds read due to a missing bounds check↗2023-04-01

▶

📋Vendor Advisories

Android

CVE-2023-20935: Android Security Bulletin 2023-04-01 CVE: CVE-2023-20935 Severity: HIGH Type: ID Affected AOSP versions: 11, 12, 12L, 13 References: A-256589724 [2]↗2023-04-01

▶