Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.1

Android system components could expose data if encryption fails

CVE-2023-21178 · published 3 years ago
Summary

The encryption step used by Android’s security policy and storage management code may sometimes skip protecting a file because of a timing mistake. If this happens, a user with system-level rights could read information they should not see, without any user interaction. Install the latest Android security update from Google or your device maker to fix the problem.

What to do
  • Update google platform/system/sepolicy to version 13-next:2023-06-01.
  • Update google platform/system/vold to version 13-next:2023-06-01.
  • Update google platform/system/sepolicy to version 13:2023-06-01.
  • Update google platform/system/vold to version 13:2023-06-01.
Affected software
Ecosystem VendorProductAffected versions
Android google platform/system/sepolicy >= 13-next:0, < 13-next:2023-06-01
>= 13:0, < 13:2023-06-01
Fix: upgrade to 13-next:2023-06-01
Android google platform/system/vold >= 13-next:0, < 13-next:2023-06-01
>= 13:0, < 13:2023-06-01
Fix: upgrade to 13-next:2023-06-01
– google android 13.0
cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*
Original advisory text
In installKey of KeyUtil.cpp, there is a possible failure of file encryption due to a race condition. This could lead to local information disclosure with System execution privileges needed. User i...
In installKey of KeyUtil.cpp, there is a possible failure of file encryption due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-362Race Condition
Timeline
Published1 Jun 2023
Updated30 Sep 2026
First seen8 Sep 2026
Sources
PUB-A-140762419 · OSV
CVE-2023-21178 · NVD
Track software like this
Free during beta