PT-2023-27283 · Google · Android

CVE-2023-40130 · Publicado 2023-10-01 · Atualizado 2025-12-08

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions prior to the fixed version

Description The issue is related to a logic error in the code of CallRedirectionProcessor.java, specifically in the onBindingDied method. This error can lead to a permission bypass, resulting in local escalation of privilege and the ability to launch background activities without additional execution privileges. User interaction is not required for exploitation.

Recommendations As a temporary workaround, consider disabling the onBindingDied method in CallRedirectionProcessor.java until a patch is available. Restrict access to the CallRedirectionProcessor class to minimize the risk of exploitation. Avoid using the affected CallRedirectionProcessor class in sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

ASB-A-289809991

CVE-2023-40130

Produtos afetados

Android

Referências · 13

• https://osv.dev/vulnerability/ASB-A-289809991 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-40130 · Nota de Segurança
• https://android.googlesource.com/platform/packages/services/Telecomm/+/a43a880beaa6a64348a1d0c821e8c7e98d741a79 · Nota
• https://twitter.com/VulmonFeeds/status/1718037572838924695 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-40130 · Aviso do Fabricante
• https://android.googlesource.com/platform/packages/services/Telecomm/+/5b335401d1c8de7d1c85f4a0cf353f7f9fc30218 · Correção
• https://t.me/cveNotify/145151 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1718004212720718212 · Publicação no Twitter
• https://source.android.com/security/bulletin/2023-10-01 · Aviso do Fabricante
• https://reddit.com/r/androiddev/comments/1oe10qe/checking_if_my_android_devices_have_critical_high · Publicação no Reddit
• https://source.android.com/security/bulletin/2025-12-01 · Nota
• https://t.me/cvenotify/93879 · Publicação no Telegram
• https://t.me/cibsecurity/73094 · Publicação no Telegram