CVE-2023-21115: High severity android vulnerability

Published Jun 5, 2023

Updated

In btmsecencryptchange of btmsec.cc, there is a possible way to downgrade the link key type due to improperly used crypto. This could lead to paired device escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12LAndroid ID: A-258834033

Affected Software

4 affected components

Google Android=11.0

Google Android=12.0

Google Android=12.1

Google Android

Event History

Jun 5, 2023

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Jun 15, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2023-21115?

CVE-2023-21115 has a high severity due to the potential for privilege escalation without user interaction.

How do I fix CVE-2023-21115?

To mitigate CVE-2023-21115, ensure that your Android device is updated to the latest security patch that addresses this vulnerability.

What types of devices are affected by CVE-2023-21115?

CVE-2023-21115 affects Android versions 11.0, 12.0, and 12.1.

Can CVE-2023-21115 be exploited remotely?

No, CVE-2023-21115 does not require user interaction for exploitation but involves pairing with a vulnerable device.

What are the implications of CVE-2023-21115 for users?

Users potentially face unauthorized privilege escalation on paired devices, which could compromise device security.