CVE-2023-40107: Use After Free
In ARTPWriter of ARTPWriter.cpp, there is a possible use after free due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/avto a version that resolves this vulnerability.Fixed in 14-next:2023-11-01 - Upgrade
Upgrade
android/platform/frameworks/avto a version that resolves this vulnerability.Fixed in 12:2023-11-01 - Upgrade
Upgrade
android/platform/frameworks/avto a version that resolves this vulnerability.Fixed in 12L:2023-11-01 - Upgrade
Upgrade
android/platform/frameworks/avto a version that resolves this vulnerability.Fixed in 13:2023-11-01 - Upgrade
Upgrade
android/platform/frameworks/avto a version that resolves this vulnerability.Fixed in 14:2023-11-01
Event History
Frequently Asked Questions
What is the severity of CVE-2023-40107?
CVE-2023-40107 is classified as a high severity vulnerability due to the potential for local escalation of privilege.
How do I fix CVE-2023-40107?
To fix CVE-2023-40107, ensure you are running updated versions of Android, specifically versions 12.1, 13.0, or 14.0 that include the security patches.
What causes CVE-2023-40107?
CVE-2023-40107 is caused by a possible use after free vulnerability due to uninitialized data in the ARTPWriter component.
Which versions of Android are affected by CVE-2023-40107?
CVE-2023-40107 affects Android versions 12.0, 12.1, 13.0, and 14.0.
Is user interaction required to exploit CVE-2023-40107?
No, user interaction is not required to exploit CVE-2023-40107.