PT-2023-17784 · Google · Android

Publicado 2023-03-24 · Atualizado 2023-03-29 · CVE-2023-20995

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions Android-13

Description The issue is related to a logic error in the code of CustomizedSensor.cpp, specifically in the captureImage function. This error can be exploited to bypass the fingerprint unlock, potentially leading to local escalation of privilege without requiring additional execution privileges. User interaction is not necessary for exploitation.

Recommendations For Android version Android-13, consider disabling the fingerprint unlock feature until a patch is available to prevent potential exploitation. Restrict access to the CustomizedSensor.cpp module to minimize the risk of escalation of privilege. Avoid using the captureImage function in CustomizedSensor.cpp until the issue is resolved.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2023-20995

Produtos afetados

Android

Referências · 5

• https://osv.dev/vulnerability/CVE-2023-20995 · Aviso do Fabricante
• https://t.me/cvenotify/47075 · Publicação no Telegram
• https://source.android.com/security/bulletin/pixel/2023-03-01 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-20995 · Nota de Segurança
• https://t.me/cibsecurity/60660 · Publicação no Telegram