Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Software may let low-level users gain admin rights

CVE-2023-21113 · published 2 years ago
Summary

Certain parts of the program can be tricked into granting higher privileges than intended, allowing a regular user to act as an administrator on the local machine. This can happen without any user interaction or special code. Apply the latest updates from the vendor and restrict who can install or run the software.

What to do
  • Update google platform/frameworks/base to version 14-next:2024-06-01.
  • Update google platform/frameworks/base to version 12:2024-06-01.
  • Update google platform/frameworks/base to version 12L:2024-06-01.
  • Update google platform/build/soong to version 13:2024-06-01.
  • Update google platform/frameworks/base to version 13:2024-06-01.
  • Update google platform/prebuilts/module_sdk/wifi to version 13:2024-06-01.
Affected software
Ecosystem VendorProductAffected versions
Android google platform/frameworks/base >= 14-next:0, < 14-next:2024-06-01
>= 12:0, < 12:2024-06-01
>= 12L:0, < 12L:2024-06-01
>= 13:0, < 13:2024-06-01
Fix: upgrade to 14-next:2024-06-01
Android google platform/build/soong >= 13:0, < 13:2024-06-01
Fix: upgrade to 13:2024-06-01
Android google platform/prebuilts/module_sdk/wifi >= 13:0, < 13:2024-06-01
Fix: upgrade to 13:2024-06-01
– google android 12.0
12.1
13.0
cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*
Original advisory text
In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interact...
In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-269Improper Privilege Management
Timeline
Published1 Jun 2024
Updated26 Oct 2026
First seen10 Sep 2026
Sources
ASB-A-267231571 · OSV
CVE-2023-21113 · NVD
Track software like this
Free during beta