PT-2023-27283 · Google · Android

Published 2023-10-01 · Updated 2025-12-08 · CVE-2023-40130

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions prior to the fixed version

Description The issue is related to a logic error in the code of CallRedirectionProcessor.java, specifically in the onBindingDied method. This error can lead to a permission bypass, resulting in local escalation of privilege and the ability to launch background activities without additional execution privileges. User interaction is not required for exploitation.

Recommendations As a temporary workaround, consider disabling the onBindingDied method in CallRedirectionProcessor.java until a patch is available. Restrict access to the CallRedirectionProcessor class to minimize the risk of exploitation. Avoid using the affected CallRedirectionProcessor class in sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

ASB-A-289809991

CVE-2023-40130

Affected Products

Android

References · 13

• https://osv.dev/vulnerability/ASB-A-289809991 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40130 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40130 · Vendor Advisory
• https://android.googlesource.com/platform/packages/services/Telecomm/+/5b335401d1c8de7d1c85f4a0cf353f7f9fc30218 · Patch
• https://source.android.com/security/bulletin/2023-10-01 · Vendor Advisory
• https://android.googlesource.com/platform/packages/services/Telecomm/+/a43a880beaa6a64348a1d0c821e8c7e98d741a79 · Note
• https://twitter.com/VulmonFeeds/status/1718037572838924695 · Twitter Post
• https://t.me/cveNotify/145151 · Telegram Post
• https://twitter.com/CVEnew/status/1718004212720718212 · Twitter Post
• https://reddit.com/r/androiddev/comments/1oe10qe/checking_if_my_android_devices_have_critical_high · Reddit Post
• https://source.android.com/security/bulletin/2025-12-01 · Note
• https://t.me/cvenotify/93879 · Telegram Post
• https://t.me/cibsecurity/73094 · Telegram Post