CVE-2023-20938: Input Validation
In bindertransactionbufferrelease of binder.c, there is a possible use after free due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-257685302References: Upstream kernel
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-20938?
CVE-2023-20938 has been classified as a vulnerability that enables local escalation of privilege.
How do I fix CVE-2023-20938?
To fix CVE-2023-20938, ensure you update to the latest release of the Android kernel available from Google.
Is user interaction necessary for exploiting CVE-2023-20938?
No, no user interaction is required for exploitation of CVE-2023-20938.
Which versions of Android are affected by CVE-2023-20938?
CVE-2023-20938 affects various versions of Google Android but specific versions include those listed under the Debian package remedy.
What may happen if CVE-2023-20938 is exploited?
Exploitation of CVE-2023-20938 could lead to an attacker gaining elevated privileges on the affected device.