ASB-A-258672042

vendorUSosv

view advisory published 2023-02-01Licence: per source

In resolveAttributionSource of ServiceUtilities.cpp, there is a possible way to disable the microphone privacy indicator due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-20934US	high7.8	0.09% (0th)	—	2023-02-28
In resolveAttributionSource of ServiceUtilities.cpp, there is a possible way to disable the microphone privacy indicator due to a permissions bypass. This could lead to local escal…

references

External citations — patches, advisories, analysis.

https://android.googlesource.com/platform/frameworks/av/+/078b6a44e4bcd8e91a9935d93e25166e27552c74FIX
https://android.googlesource.com/platform/frameworks/base/+/7fa5e42281f9ceb827b594cfee598a1814ac2c50FIX
https://source.android.com/security/bulletin/2023-02-01ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan