Possible Malicious Update to APEX Module Framework Could Lead to Local Escalation of Privilege

CVE-2023-45779
7.8HIGH

Key Information

Vendor
Google
Status
Android
Vendor
CVE Published:
4 December 2023

Badges

👾 Exploit Exists📰 News Worthy

Summary

In TBD of TBD, there is a possible malicious update to platform components due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Version(s)

Android = Android SoC

News Articles

favicon imagePak Media Blog

Exploit Released For Android Local Elevation Flaw Impacting 7 Oems

A proof-of-concept (PoC) exploit for a local privilege elevation flaw impacting at least seven Android original equipment manufacturers (OEMs) is now publicly available on GitHub. However, as the exploit requires local access, its release will mostly be helpful to...

10 months ago

favicon imageOP Innovate

Public Release of Exploit for Android Privilege Elevation Flaw Affecting Multiple OEMs (CVE-2023-45779) - OP INNOVATE

A PoC exploit for CVE-2023-45779, a local privilege elevation vulnerability affecting Android devices from multiple OEMs, is now public on GitHub. Discovered by Meta's Red Team X, the flaw involves insecurely signed APEX modules using test keys, potentially enabling malicious updates and full device...

10 months ago

favicon imageTechWar.GR

Exploit released for Android local lifting flaw affecting 7 OEMs

A proof-of-concept (PoC) exploit for a local privilege elevation flaw affecting at least seven OEMs

10 months ago

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • First article discovered by Beeping Computers

  • 👾

    Exploit exists.

  • Vulnerability published.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database0 Proof of Concept(s)6 News Article(s)
.