ASB-A-258422561

vendorUSosv

view advisory published 2023-03-01Licence: per source

In onAttach of SettingsPreferenceFragment.java, there is a possible bypass of Factory Reset Protections due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-20957US	high7.8	0.09% (0th)	—	2023-03-24
In onAttach of SettingsPreferenceFragment.java, there is a possible bypass of Factory Reset Protections due to a confused deputy. This could lead to local escalation of privilege w…

references

External citations — patches, advisories, analysis.

https://android.googlesource.com/platform/packages/apps/Settings/+/1cf31d17aae6798e6174f6b4eaf60603352aa7f7FIX
https://source.android.com/security/bulletin/2023-03-01ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan