CVE-2023-20911: High severity Google Android vulnerability

Published Mar 6, 2023

Updated

In addPermission of PermissionManagerServiceImpl.java , there is a possible failure to persist permission settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-242537498

Affected Software

5 affected components

Google Android=11.0

Google Android=12.0

Google Android=12.1

Google Android=13.0

Google Android

Event History

Mar 6, 2023

CVE Published

via Android·12:00 AM

Mar 24, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Data Sourced

via NVD·08:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2023-20911?

CVE-2023-20911 is a vulnerability in the addPermission function of PermissionManagerServiceImpl.java that could lead to local escalation of privilege on Google Android 11.0, 12.0, 12.1, and 13.0.

What is the severity of CVE-2023-20911?

The severity of CVE-2023-20911 is high with a CVSS score of 7.8.

How does CVE-2023-20911 impact Google Android?

CVE-2023-20911 could lead to local escalation of privilege on Google Android 11.0, 12.0, 12.1, and 13.0.

Is user interaction required for exploitation of CVE-2023-20911?

No, user interaction is not needed for exploitation of CVE-2023-20911.

How can I fix CVE-2023-20911?

To fix CVE-2023-20911, it is recommended to apply the security patches provided by Google for affected versions of Google Android.