Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2023-21399: Android could let local users gain higher privileges
CVE-2023-21399 · published 3 years ago
Summary
A coding mistake in Android may let someone with basic access on the device raise their permission level without any special actions. This can let an attacker control more of the system than intended. Apply the latest Android security updates or patches to fix the issue.
What to do
- Update google :unknown: to version Pixel-family specific:2023-07-05.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Android | :unknown: |
>= Pixel-family specific:0, < Pixel-family specific:2023-07-05 Fix: upgrade to Pixel-family specific:2023-07-05
|
|
| – | android |
All versions
cpe:2.3:o:google:android:-:*:*:*:*:*:*:* |
Original advisory text
there is a possible way to bypass cryptographic assurances due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User in...
there is a possible way to bypass cryptographic assurances due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
- https://source.android.com/security/bulletin/2023-07-01 Vendor Advisory
- https://source.android.com/security/bulletin/pixel/2023-07-01 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
7.8
High
Type
CWE-327Use of a Broken Cryptographic Algorithm
Timeline
Published1 Jul 2023
Updated30 Sep 2026
First seen10 Sep 2026
Track software like this
Free during beta