CVE-2023-20696: Medium severity Google Android vulnerability
In preloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07856356 / ALPS07874388 (For MT6880 and MT6890 only); Issue ID: ALPS07856356 / ALPS07874388 (For MT6880 and MT6890 only).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/:unknown:to a version that resolves this vulnerability.Fixed in SoCVersion:2023-05-05 - Upgrade
Upgrade
preloaderto a version that resolves this vulnerability.Patch ALPS07856356 / ALPS07874388
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2023-20696.
What is the severity of CVE-2023-20696?
The severity of CVE-2023-20696 is high.
Is user interaction required for exploitation?
No, user interaction is not needed for exploitation of CVE-2023-20696.
Which software versions are affected by CVE-2023-20696?
Google Android 13.0, Openwrt 19.07.0, and Openwrt 21.02.0 are affected by CVE-2023-20696.
How can I fix CVE-2023-20696?
To fix CVE-2023-20696, apply the patch provided by the vendor.