CVE-2023-20938: Input Validation
In bindertransactionbufferrelease of binder.c, there is a possible use after free due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-257685302References: Upstream kernel
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/:linux_kernel:to a version that resolves this vulnerability.Fixed in :2023-02-05 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2023-20938?
CVE-2023-20938 has been classified as a vulnerability that enables local escalation of privilege.
How do I fix CVE-2023-20938?
To fix CVE-2023-20938, ensure you update to the latest release of the Android kernel available from Google.
Is user interaction necessary for exploiting CVE-2023-20938?
No, no user interaction is required for exploitation of CVE-2023-20938.
Which versions of Android are affected by CVE-2023-20938?
CVE-2023-20938 affects various versions of Google Android but specific versions include those listed under the Debian package remedy.
What may happen if CVE-2023-20938 is exploited?
Exploitation of CVE-2023-20938 could lead to an attacker gaining elevated privileges on the affected device.