Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.7
CVE-2023-32873: Google Android may let attacker gain system privileges
CVE-2023-32873 · published 2 years ago
Summary
A part of Google Android called keyInstall can write data to the wrong place in memory. This can let someone who already has limited access take full control of the device without any user interaction. Apply the latest Android security update that contains Google's patch as soon as possible.
What to do
- Update google :unknown: to version SoCVersion:2024-05-05.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Android | :unknown: |
>= SoCVersion:0, < SoCVersion:2024-05-05 Fix: upgrade to SoCVersion:2024-05-05
|
|
| – | android |
12.0 13.0 14.0 cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:* |
Original advisory text
ASB-A-327972597
In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08583919; Issue ID: ALPS08304227.
References
- https://corp.mediatek.com/product-security-bulletin/May-2024 Vendor Advisory
- https://source.android.com/security/bulletin/2024-05-01 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
6.7
Medium
Type
CWE-787Out-of-bounds Write
Timeline
Published1 May 2024
Updated30 Sep 2026
First seen10 Sep 2026
Track software like this
Free during beta