CVE-2023-20627: Medium severity Google Android vulnerability

Published Mar 7, 2023

Updated

In pqframework, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07629585; Issue ID: ALPS07629585.

Affected Software

14 affected components

All of the following

Any of the following

Google Android=12.0

Google Android=13.0

Any of the following

MediaTek Mt6879

MediaTek Mt6895

MediaTek Mt6983

MediaTek Mt8167

MediaTek Mt8168

Google Android=12.0

Google Android=13.0

MediaTek Mt6879

MediaTek Mt6895

MediaTek Mt6983

MediaTek Mt8167

MediaTek Mt8168

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pqframework to a version that resolves this vulnerability.
Patch ALPS07629585

Event History

Mar 7, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Data Sourced

via NVD·09:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-20627?

The severity of CVE-2023-20627 is medium, with a severity value of 6.7.

How can I exploit CVE-2023-20627?

User interaction is not needed for exploitation of CVE-2023-20627.

How can I fix CVE-2023-20627?

Apply the patch with Patch ID ALPS07629585 to mitigate CVE-2023-20627.

Is Google Android 12.0 affected by CVE-2023-20627?

Yes, Google Android 12.0 is affected by CVE-2023-20627.

Is there a product security bulletin for CVE-2023-20627?

Yes, you can find the product security bulletin for CVE-2023-20627 here: https://corp.mediatek.com/product-security-bulletin/March-2023