PT-2023-17980 · Google · Android

CVE-2023-21192 · Publicado 2023-06-28 · Atualizado 2023-07-05

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android version Android-13

Description The issue is related to improper input validation in the setInputMethodWithSubtypeIdLocked function of InputMethodManagerService.java. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not required for exploitation.

Recommendations For Android version Android-13, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the setup of input methods to prevent potential exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2023-21192

Produtos afetados

Android

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-21192 · Nota de Segurança
• https://t.me/cibsecurity/65671 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-21192 · Aviso do Fabricante
• https://source.android.com/security/bulletin/pixel/2023-06-01 · Aviso do Fabricante