PT-2023-17997 · Google · Android

Published 2023-06-28 · Updated 2024-12-04 · CVE-2023-21208

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android version Android-13

Description In the setCountryCodeInternal function of sta iface.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

Recommendations For Android version Android-13, update to a version that includes the fix for the issue in setCountryCodeInternal of sta iface.cpp. As a temporary workaround, consider restricting access to sensitive information to minimize the risk of exploitation.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2023-21208

Affected Products

Android

References · 5

• https://osv.dev/vulnerability/CVE-2023-21208 · Vendor Advisory
• https://source.android.com/security/bulletin/pixel/2023-06-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-21208 · Security Note
• https://t.me/cvenotify/103022 · Telegram Post
• https://t.me/cvenotify/53226 · Telegram Post