CVE-2023-21115
published 2023-06-15CVE-2023-21115: In btm_sec_encrypt_change of btm_sec.cc, there is a possible way to downgrade the link key type due to improperly used crypto. This could lead to paired device…
PriorityP344high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
EPSS
0.10%
1.3th percentile
In btm_sec_encrypt_change of btm_sec.cc, there is a possible way to downgrade the link key type due to improperly used crypto. This could lead to paired device escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12LAndroid ID: A-258834033
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| platform | system_bt | >= 11:0 < 11:2023-06-01 | 11:2023-06-01 |
| platform | system_bt | >= 12:0 < 12:2023-06-01 | 12:2023-06-01 |
| platform | system_bt | >= 12L:0 < 12L:2023-06-01 | 12L:2023-06-01 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Android
CVE-2023-21115: Android Security Bulletin 2023-06-01
CVE: CVE-2023-21115
Severity: HIGH
Type: EoP
Affected AOSP versions: 11, 12, 12L
References: A-258834033
vendor_android·2023-06-01·CVSS 8.8
CVE-2023-21115 [HIGH] CVE-2023-21115: Android Security Bulletin 2023-06-01
CVE: CVE-2023-21115
Severity: HIGH
Type: EoP
Affected AOSP versions: 11, 12, 12L
References: A-258834033
Android Security Bulletin 2023-06-01
CVE: CVE-2023-21115
Severity: HIGH
Type: EoP
Affected AOSP versions: 11, 12, 12L
References: A-258834033
GHSA
GHSA-8mvr-47qj-w5j5: In btm_sec_encrypt_change of btm_sec
ghsa_unreviewed·2023-06-15
CVE-2023-21115 [HIGH] CWE-327 GHSA-8mvr-47qj-w5j5: In btm_sec_encrypt_change of btm_sec
In btm_sec_encrypt_change of btm_sec.cc, there is a possible way to downgrade the link key type due to improperly used crypto. This could lead to paired device escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12LAndroid ID: A-258834033
OSV
CVE-2023-21115: In btm_sec_encrypt_change of btm_sec
osv·2023-06-01
CVE-2023-21115 CVE-2023-21115: In btm_sec_encrypt_change of btm_sec
In btm_sec_encrypt_change of btm_sec.cc, there is a possible way to downgrade the link key type due to improperly used crypto. This could lead to paired device escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-06-15
Published