CVE-2023-21237: Android Pixel Information Disclosure Vulnerability
Android Pixel contains a vulnerability in the Framework component, where the UI may be misleading or insufficient, providing a means to hide a foreground service notification. This could enable a local attacker to disclose sensitive information.
Other sources
In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
— OSV
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 13-next:2023-06-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 13:2023-06-01 - Compensating control
Discontinue use of Android Pixel if vendor mitigations are unavailable.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-21237?
CVE-2023-21237 is classified as a medium severity vulnerability due to its potential impact on sensitive information disclosure.
How does CVE-2023-21237 affect users?
CVE-2023-21237 may mislead users by hiding a foreground service notification, allowing a local attacker to access sensitive information.
What versions of Android are affected by CVE-2023-21237?
CVE-2023-21237 affects Android 13.0 on Google Pixel devices.
How do I fix CVE-2023-21237?
To mitigate CVE-2023-21237, update your Android device to the latest security patch provided by Google.
Is CVE-2023-21237 exploitable remotely?
CVE-2023-21237 is not remotely exploitable, as it requires local access to the affected device.