CVE-2023-20942

In openMmapStream of AudioFlinger.cpp, there is a possible way to record audio without displaying the microphone privacy indicator due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://android.googlesource.com/platform/frameworks/av/+/770b45c3c1619cf4008b89e7a0f4392bf2224bbc	Patch
https://android.googlesource.com/platform/frameworks/av/+/b072419650958c41c87d2baa572dc2fe6da9ea6b	Patch
https://android.googlesource.com/platform/frameworks/av/+/bae3b00a5873d1562679a1289fd8490178cfe064	Patch
https://source.android.com/security/bulletin/2023-07-01	Patch Vendor Advisory
https://android.googlesource.com/platform/frameworks/av/+/770b45c3c1619cf4008b89e7a0f4392bf2224bbc	Patch
https://android.googlesource.com/platform/frameworks/av/+/b072419650958c41c87d2baa572dc2fe6da9ea6b	Patch
https://android.googlesource.com/platform/frameworks/av/+/bae3b00a5873d1562679a1289fd8490178cfe064	Patch
https://source.android.com/security/bulletin/2023-07-01	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:google:android:12.0:::::::*
	cpe:2.3:o:google:android:12.1:::::::*
	cpe:2.3:o:google:android:13.0:::::::*

History

21 Nov 2024, 07:41

Type	Values Removed	Values Added
References	~~() https://android.googlesource.com/platform/frameworks/av/+/770b45c3c1619cf4008b89e7a0f4392bf2224bbc - Patch~~	() https://android.googlesource.com/platform/frameworks/av/+/770b45c3c1619cf4008b89e7a0f4392bf2224bbc - Patch
References	~~() https://android.googlesource.com/platform/frameworks/av/+/b072419650958c41c87d2baa572dc2fe6da9ea6b - Patch~~	() https://android.googlesource.com/platform/frameworks/av/+/b072419650958c41c87d2baa572dc2fe6da9ea6b - Patch
References	~~() https://android.googlesource.com/platform/frameworks/av/+/bae3b00a5873d1562679a1289fd8490178cfe064 - Patch~~	() https://android.googlesource.com/platform/frameworks/av/+/bae3b00a5873d1562679a1289fd8490178cfe064 - Patch
References	~~() https://source.android.com/security/bulletin/2023-07-01 - Patch, Vendor Advisory~~	() https://source.android.com/security/bulletin/2023-07-01 - Patch, Vendor Advisory

06 Nov 2024, 17:35

Type	Values Removed	Values Added
CWE		CWE-326

25 Jul 2023, 17:42

Type	Values Removed	Values Added
CPE		cpe:2.3:o:google:android:12.1:::::::* cpe:2.3:o:google:android:13.0:::::::* cpe:2.3:o:google:android:12.0:::::::*
CWE		NVD-CWE-noinfo
References	~~(MISC) https://android.googlesource.com/platform/frameworks/av/+/bae3b00a5873d1562679a1289fd8490178cfe064 -~~	(MISC) https://android.googlesource.com/platform/frameworks/av/+/bae3b00a5873d1562679a1289fd8490178cfe064 - Patch
References	~~(MISC) https://android.googlesource.com/platform/frameworks/av/+/770b45c3c1619cf4008b89e7a0f4392bf2224bbc -~~	(MISC) https://android.googlesource.com/platform/frameworks/av/+/770b45c3c1619cf4008b89e7a0f4392bf2224bbc - Patch
References	~~(MISC) https://source.android.com/security/bulletin/2023-07-01 -~~	(MISC) https://source.android.com/security/bulletin/2023-07-01 - Patch, Vendor Advisory
References	~~(MISC) https://android.googlesource.com/platform/frameworks/av/+/b072419650958c41c87d2baa572dc2fe6da9ea6b -~~	(MISC) https://android.googlesource.com/platform/frameworks/av/+/b072419650958c41c87d2baa572dc2fe6da9ea6b - Patch
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5

13 Jul 2023, 00:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-07-13 00:15

Updated : 2024-11-21 07:41

NVD link : CVE-2023-20942

Mitre link : CVE-2023-20942

CVE.ORG link : CVE-2023-20942

JSON object : View

Products Affected

google

android

CWE

NVD-CWE-noinfo CWE-326

Inadequate Encryption Strength

5.5 /10