Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-20656: Android could let attackers gain system privileges

CVE-2023-20656 · published 3 years ago

Summary

A coding mistake in the Android system can let someone with access to the device write data outside of its intended area, potentially giving them full control of the device. This can happen without the user doing anything. Apply the latest Android security update that includes the fix as soon as possible.

What to do

Update google :unknown: to version SoCVersion:2023-04-05.

Affected software

Ecosystem	Vendor	Product	Affected versions
Android	google	:unknown:	>= SoCVersion:0, < SoCVersion:2023-04-05 Fix: upgrade to SoCVersion:2023-04-05
–	google	android	10.0 11.0 12.0 13.0 `cpe:2.3:o:google:android:10.0:::::::*`

Original advisory text

ASB-A-267957665

In geniezone, there is a possible out of bounds write due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07571494; Issue ID: ALPS07571494.

References

https://source.android.com/security/bulletin/2023-04-01 Vendor Advisory
https://corp.mediatek.com/product-security-bulletin/April-2023 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

6.7 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published1 Apr 2023

Updated30 Sep 2026

First seen10 Sep 2026

Sources

ASB-A-267957665 · OSV

CVE-2023-20656 · NVD

Track software like this

Free during beta