Potential Local Escalation of Privilege Vulnerability in PermissionManagerServiceImpl

CVE-2023-21270

What is CVE-2023-21270?

In the PermissionManagerServiceImpl.java of Android, a flaw exists in the restorePermissionState function that could allow malicious applications to retain permissions they should have lost after system updates. Incorrect handling of permission flags means that apps might bypass the intended restrictions designed to revoke certain permissions. Exploitation of this vulnerability necessitates user execution privileges, enabling attackers to escalate their access without needing any user interaction, which amplifies the risk profile associated with this vulnerability.

References