ASB-A-222446076

vendorUSosv

view advisory published 2024-01-01Licence: per source

In showNextSecurityScreenOrFinish of KeyguardSecurityContainerController.java, there is a possible way to access the lock screen during device setup due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-21245US	high7.8OT elevated	0.09% (1st)	—	2023-07-13
In showNextSecurityScreenOrFinish of KeyguardSecurityContainerController.java, there is a possible way to access the lock screen during device setup due to a logic error in the cod…

references

External citations — patches, advisories, analysis.

https://android.googlesource.com/platform/frameworks/base/+/a33159e8cb297b9eee6fa5c63c0e343d05fad622FIX
https://android.googlesource.com/platform/frameworks/base/+/d42f8d774901e8bcdf2c83b61b01fad79ce2f69fFIX
https://source.android.com/security/bulletin/2024-01-01ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan