A vulnerability was found in Google Android 12.0/13.0 (Smartphone Operating System) and classified as critical. This issue affects the function deliverOnFlushComplete of the file LocationProviderManager.java. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In deliverOnFlushComplete of LocationProviderManager.java, there is a possible way to bypass background activity launch restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-235823542

The weakness was published 04/20/2023 as A-235823542. It is possible to read the advisory at source.android.com. The identification of this vulnerability is CVE-2023-21088 since 11/03/2022. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 05/14/2023). It is expected to see the exploit prices for this product increasing in the near future.The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Applying a patch is able to eliminate this problem.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

Version

• 12.0
• 13.0

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion