ASB-A-253043065

vendorUSosv

view advisory published 2023-10-01Licence: per source

In resetSettingsLocked of SettingsProvider.java, there is a possible lockscreen bypass due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-40117US	high7.8OT elevated	0.10% (1st)	—	2023-10-27
In resetSettingsLocked of SettingsProvider.java, there is a possible lockscreen bypass due to a permissions bypass. This could lead to local escalation of privilege with no additio…

references

External citations — patches, advisories, analysis.

https://android.googlesource.com/platform/frameworks/base/+/ff86ff28cf82124f8e65833a2dd8c319aea08945FIX
https://android.googlesource.com/platform/packages/apps/Settings/+/11815817de2f2d70fe842b108356a1bc75d44ffbFIX
https://source.android.com/security/bulletin/2023-10-01ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan