CVE-2023-40105: Medium severity Google Android vulnerability
In backupAgentCreated of ActivityManagerService.java, there is a possible way to leak sensitive data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 14-next:2023-11-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 11:2023-11-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 12:2023-11-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 12L:2023-11-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 13:2023-11-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 14:2023-11-01
Event History
Frequently Asked Questions
What is the severity of CVE-2023-40105?
CVE-2023-40105 has been rated as a moderate severity vulnerability due to potential local information disclosure.
How do I fix CVE-2023-40105?
To mitigate CVE-2023-40105, update your device to the latest version of Android that includes the security patch.
Which versions of Android are affected by CVE-2023-40105?
CVE-2023-40105 affects Android versions 11.0, 12.0, 12.1, 13.0, and 14.0.
How can CVE-2023-40105 be exploited?
CVE-2023-40105 can be exploited through a missing permission check, allowing sensitive data leakage without user interaction.
Is user interaction required to exploit CVE-2023-40105?
No, user interaction is not required to exploit CVE-2023-40105, making it particularly concerning.