Rewterz Threat Advisory – Multiple Google Android Vulnerabilities

Severity

High

Analysis Summary

CVE-2023-40081 CVSS:6.2

Google Android could allow a local attacker to obtain sensitive information, caused by a confused deputy in loadMediaDataInBgForResumption of MediaDataManager.kt. By executing a specially crafted application, an attacker could exploit this vulnerability to obtain sensitive information and use this information to launch further attacks against the affected system.

CVE-2023-40088 CVSS:8.8

Google Android could allow a remote attacker within the local network to execute arbitrary code on the system, caused by a use-after-free in callback_thread_event in the com_android_bluetooth_btservice_AdapterService.cpp script. By executing a specially crafted application, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVE-2023-40089 CVSS:8.4

Google Android Framework could allow a local attacker to gain elevated privileges on the system, caused by missing permissions checks in getCredentialManagerPolicy in the DevicePolicyManagerService.java script. By sending a specially crafted request, an attacker could exploit this vulnerability to gain elevated privileges on the system.

CVE-2023-40090 CVSS:8.4

Google Android could allow a local attacker to gain elevated privileges on the system, caused by side-channel information disclosure in BTM_BleVerifySignature in the btm_ble.cc script. By sending a specially crafted request, an attacker could exploit this vulnerability to gain elevated privileges on the system.

CVE-2023-40091 CVSS:8.4

Google Android Framework could allow a local attacker to gain elevated privileges on the system, caused by memory corruption in onTransact in the IncidentService.cpp script. By sending a specially crafted request, an attacker could exploit this vulnerability to gain elevated privileges on the system.

CVE-2023-40094 CVSS:8.4

Google Android Framework could allow a local attacker to gain elevated privileges on the system, caused by missing permissions checks in keyguardGoingAway in the ActivityTaskManagerService.java script. By sending a specially crafted request, an attacker could exploit this vulnerability to gain elevated privileges on the system.

CVE-2023-40095 CVSS:8.4

Google Android Framework could allow a local attacker to gain elevated privileges on the system, caused by missing checks in createDontSendToRestrictedAppsBundle in the PendingIntentUtils.java script. By sending a specially crafted request, an attacker could exploit this vulnerability to gain elevated privileges on the system.

CVE-2023-40096 CVSS:7.8

Google Android Framework could allow a local authenticated attacker to gain elevated privileges on the system, caused by a missing flag in OpRecordAudioMonitor::onFirstRef in the AudioRecordClient.cpp script. By sending a specially crafted request, an attacker could exploit this vulnerability to gain elevated privileges on the system.

CVE-2023-40097 CVSS:7.8

Google Android could allow a local attacker to gain elevated privileges on the system, caused by improper input validation in hasPermissionForActivity in the PackageManagerHelper.java script. By sending a specially crafted request, an attacker could exploit this vulnerability to gain elevated privileges on the system.

CVE-2023-40103 CVSS:8.4

Google Android could allow a local attacker to gain elevated privileges on the system, caused by a double-free. By sending a specially crafted request, an attacker could exploit this vulnerability to gain elevated privileges on the system.

Impact

• Privileges Escalation
• Information Disclosure
• Code Execution

Indicators Of Compromise

CVE

• CVE-2023-40081
• CVE-2023-40088
• CVE-2023-40089
• CVE-2023-40090
• CVE-2023-40091
• CVE-2023-40094
• CVE-2023-40095
• CVE-2023-40096
• CVE-2023-40097
• CVE-2023-40103

Affected Vendors

Google

Affected Products

• Google Android 12
• Google Android 11
• Google Android 12L
• Google Android 13
• Google Android 14

Remediation

Refer to the Android Open Source Project for patch, upgrade or suggested workaround information.

Android Open Source Project