CVE-2023-35677: Medium severity Google Android vulnerability

Published Sep 5, 2023

Updated

In onCreate of DeviceAdminAdd.java, there is a possible way to forcibly add a device admin due to a missing permission check. This could lead to local denial of service (factory reset or continuous locking) with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

5 affected components

Google Android=11.0

Google Android=12.0

Google Android=12.1

Google Android=13.0

Google Android

Event History

Sep 5, 2023

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Sep 11, 2023

CVE Published

via MITRE·08:09 PM

Data Sourced

via MITRE·08:09 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2023-35677?

The severity of CVE-2023-35677 is high.

How can CVE-2023-35677 be exploited?

CVE-2023-35677 can be exploited by forcibly adding a device admin without the proper permission check, leading to local denial of service.

What versions of Android are affected by CVE-2023-35677?

Android versions 11.0, 12.0, 12.1, and 13.0 are affected by CVE-2023-35677.

Is user interaction required for exploitation of CVE-2023-35677?

No, user interaction is not needed for the exploitation of CVE-2023-35677.

Are there any references for CVE-2023-35677?

Yes, you can find references for CVE-2023-35677 at the following links: [link1](https://android.googlesource.com/platform/packages/apps/Settings/+/846180c19f68f6fb1b0653356401d3235fef846e), [link2](https://source.android.com/security/bulletin/2023-09-01), [link3](https://source.android.com/docs/security/bulletin/2023-09-01).