CVE-2023-21115 — Use of a Broken or Risky Cryptographic Algorithm in Google Android

CWE-327 — Use of a Broken or Risky Cryptographic Algorithm5 documents5 sources
Severity
8.8HIGHNVD
EPSS
0.0%
top 95.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Platform System BTGoogle Android
Timeline
PublishedJun 15

Description

In btm_sec_encrypt_change of btm_sec.cc, there is a possible way to downgrade the link key type due to improperly used crypto. This could lead to paired device escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12LAndroid ID: A-258834033

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5google/androidAndroid-11 Android-12 Android-12L
▶NVDgoogle/android11.0, 12.0, 12.1+2
▶Androidplatform/system_bt11:0 — 11:2023-06-01+2

🔴Vulnerability Details

3
CVEList
CVE-2023-21115: In btm_sec_encrypt_change of btm_sec↗2023-06-15
▶
GHSA
GHSA-8mvr-47qj-w5j5: In btm_sec_encrypt_change of btm_sec↗2023-06-15
▶
OSV
CVE-2023-21115: In btm_sec_encrypt_change of btm_sec↗2023-06-01
▶

📋Vendor Advisories

1
Android
CVE-2023-21115: Android Security Bulletin 2023-06-01 CVE: CVE-2023-21115 Severity: HIGH Type: EoP Affected AOSP versions: 11, 12, 12L References: A-258834033↗2023-06-01
▶
CVE-2023-21115 — Google Android vulnerability | cvebase