CVE-2023-35687: Use After Free

Published Sep 5, 2023

Updated

In MtpPropertyValue of MtpProperty.h, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

5 affected components

Google Android=11.0

Google Android=12.0

Google Android=12.1

Google Android=13.0

Google Android

Remediation

Patch Available

https://android.googlesource.com/platform/frameworks/av/+/ea6131efa76a0b2a12724ffd157909e2c6fb4036

Event History

Sep 5, 2023

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Sep 11, 2023

CVE Published

via MITRE·08:09 PM

Data Sourced

via MITRE·08:09 PM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID of this issue?

The vulnerability ID is CVE-2023-35687.

What is the severity of CVE-2023-35687?

The severity of CVE-2023-35687 is high.

How does CVE-2023-35687 impact Google Android?

CVE-2023-35687 could lead to local escalation of privilege on Google Android devices.

Is user interaction required for exploiting CVE-2023-35687?

No, user interaction is not needed for exploitation of CVE-2023-35687.

Are there any references available for CVE-2023-35687?

Yes, you can find references for CVE-2023-35687 at the following links: [Link 1](https://android.googlesource.com/platform/frameworks/av/+/ea6131efa76a0b2a12724ffd157909e2c6fb4036), [Link 2](https://source.android.com/security/bulletin/2023-09-01), [Link 3](https://source.android.com/docs/security/bulletin/2023-09-01).