PT-2023-5066 · Google · Android

Published 2023-05-23 · Updated 2024-12-20 · CVE-2023-35674

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions prior to the September 2023 security updates

Description The issue is related to a logic error in the code of WindowState.java, specifically in the onCreate method, which can lead to local escalation of privilege with no additional execution privileges needed. User interaction is not required for exploitation. This flaw is being actively exploited in the wild, and it is estimated that a significant number of devices may be affected. The vulnerability allows an attacker to escalate privileges.

Recommendations To resolve the issue, update your Android device to the latest version that includes the September 2023 security updates. As a temporary workaround, consider restricting access to sensitive features and data on your device until the update is applied.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-371

CWE-269

Related Identifiers

ASB-A-264029851

BDU:2023-05625

CVE-2023-35674

Affected Products

Android

References · 58

• https://source.android.com/security/bulletin/2023-09-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05625 · Security Note
• https://osv.dev/vulnerability/ASB-A-264029851 · Vendor Advisory
• https://android.googlesource.com/platform/frameworks/base/+/7428962d3b064ce1122809d87af65099d1129c9e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-35674 · Security Note
• https://source.android.com/docs/security/bulletin/2023-09-01 · Security Note
• https://osv.dev/vulnerability/CVE-2023-35674 · Vendor Advisory
• https://twitter.com/TodayCyberNews/status/1699434858852802968 · Twitter Post
• https://twitter.com/BesecureIT/status/1699768299565830462 · Twitter Post
• https://twitter.com/SecurityWeek/status/1699392802013298742 · Twitter Post
• https://twitter.com/socradar/status/1699754783899353569 · Twitter Post
• https://twitter.com/gierek_grzegorz/status/1699588112224063740 · Twitter Post
• https://t.me/cvenotify/96509 · Telegram Post
• https://t.me/true_secator/4818 · Telegram Post
• https://twitter.com/CeptBiro/status/1699773829898280966 · Twitter Post