CVE-2023-32884 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Google Android

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-78 — OS Command Injection4 documents4 sources
Severity
6.7MEDIUMNVD
EPSS
0.0%
top 94.49%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Google AndroidMsrc Cbl2 Rust 1.72.0-10 ON CBL Mariner 2.0
Timeline
PublishedJan 2
Latest updateJul 28

Description

In netdagent, there is a possible information disclosure due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07944011; Issue ID: ALPS07944011.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages2 packages

▶NVDgoogle/android12.0, 13.0+1

🔴Vulnerability Details

1
GHSA
GHSA-q6w4-3x9w-4364: In netdagent, there is a possible information disclosure due to an incorrect bounds check↗2024-01-02
▶

📋Vendor Advisories

2
Red Hat
gix-transport: gix Command Execution Vulnerability↗2025-07-28
▶
Microsoft
The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnera↗2025-07-08
▶