PT-2023-17846 · Google · Android Kernel

CVE-2023-21055 · Publicado 2023-03-24 · Atualizado 2025-02-21

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android kernel

Description The issue is related to a possible use after free due to a race condition in the dit hal ioctl function of dit.c. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Recommendations For Android kernel, consider applying a patch or fix that addresses the use after free issue in the dit hal ioctl function to prevent local escalation of privilege. As a temporary workaround, restricting access to the dit hal ioctl function may help minimize the risk of exploitation.

Correção

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

CVE-2023-21055

Produtos afetados

Android Kernel

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-21055 · Nota de Segurança
• https://source.android.com/security/bulletin/pixel/2023-03-01 · Aviso do Fabricante
• https://t.me/cvenotify/112097 · Publicação no Telegram
• https://t.me/cibsecurity/60679 · Publicação no Telegram