CVE-2023-21135 — Improper Input Validation in Packages Apps Settings

CWE-20 — Improper Input ValidationCWE-120 — Classic Buffer Overflow5 documents5 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 98.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Platform Frameworks BasePlatform Packages Apps SettingsGoogle Android
Timeline
PublishedJun 15

Description

In onCreate of NotificationAccessSettings.java, there is a possible failure to persist notifications settings due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-260570119

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5google/androidAndroid-11 Android-12 Android-12L Android-13
▶NVDgoogle/android4 versions+3
▶Androidplatform/packages_apps_settings13-next:0 — 13-next:2023-06-01+4
▶Androidplatform/frameworks_base13-next:0 — 13-next:2023-06-01+4

Patches

Patch: source.android.com ↗Patch: source.android.com ↗

🔴Vulnerability Details

3
CVEList
CVE-2023-21135: In onCreate of NotificationAccessSettings↗2023-06-15
▶
GHSA
GHSA-c2q6-w4g5-fhfr: In onCreate of NotificationAccessSettings↗2023-06-15
▶
OSV
CVE-2023-21135: In onCreate of NotificationAccessSettings↗2023-06-01
▶

📋Vendor Advisories

1
Android
CVE-2023-21135: Android Security Bulletin 2023-06-01 CVE: CVE-2023-21135 Severity: HIGH Type: EoP Affected AOSP versions: 11, 12, 12L, 13 References: A-260570119 [2]↗2023-06-01
▶
CVE-2023-21135 — Improper Input Validation | cvebase