PT-2023-17816 · Google · Android

Publicado 2023-03-24 · Atualizado 2023-03-30 · CVE-2023-21026

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Android version Android-13

Description In the updateInputChannel function of WindowManagerService.java, a logic error allows setting a touchable region beyond its own SurfaceControl. This could lead to local denial of service without needing additional execution privileges. User interaction is not required for exploitation.

Recommendations For Android version Android-13, apply the necessary patch or update to resolve the issue. As a temporary workaround, consider restricting access to the updateInputChannel function in WindowManagerService.java to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-703

Identificadores relacionados

CVE-2023-21026

Produtos afetados

Android

Referências · 5

• https://osv.dev/vulnerability/CVE-2023-21026 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-21026 · Nota de Segurança
• https://source.android.com/security/bulletin/pixel/2023-03-01 · Aviso do Fabricante
• https://t.me/cvenotify/47162 · Publicação no Telegram
• https://t.me/cibsecurity/60665 · Publicação no Telegram