CVE-2023-45779

Published: Dec 4, 2023Modified: Nov 21, 2024

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

In the APEX module framework of AOSP, there is a possible malicious update to platform components due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. More details on this can be found in the referenced links.

Affected (1)

Products: Google: Android

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Google Android	All versions

References (8)

https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-wmcc-g67r-9962

Source: security@android.com

https://rtx.meta.security/exploitation/2024/01/30/Android-vendors-APEX-test-keys.html

Source: security@android.com

https://source.android.com/security/bulletin/2023-12-01

Source: security@android.com

Vendor Advisory

https://www.fairphone.com/en/2024/01/30/security-update-apex-modules-vulnerability-fixed/

Source: security@android.com

https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-wmcc-g67r-9962

Source: af854a3a-2127-422b-91ae-364da2661108

https://rtx.meta.security/exploitation/2024/01/30/Android-vendors-APEX-test-keys.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://source.android.com/security/bulletin/2023-12-01

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.fairphone.com/en/2024/01/30/security-update-apex-modules-vulnerability-fixed/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.