CVE-2023-40108: Infoleak
In multiple locations, there is a possible way to access media content belonging to another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement and enforce permission checks in all code paths that serve or enumerate media content so that the requesting UID/profile is verified as the owner before any media is returned. Ensure APIs that expose media perform per-user ownership checks and deny access when the ownership check fails.
Android media access layer permission_checks_for_media_access = enforced (verify requesting user/profile owns target media) - Compensating control
Until code fixes are deployed, restrict cross-user access to media by applying OS-level controls: enforce filesystem ACLs and SELinux policies to prevent other users from reading another user's media, and isolate or disable shared profiles/features that allow media access across users.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-40108?
CVE-2023-40108 is classified as a medium severity vulnerability due to the potential for local information disclosure.
How do I fix CVE-2023-40108?
To fix CVE-2023-40108, ensure that you apply the latest security updates provided by your device manufacturer.
What impact does CVE-2023-40108 have on user privacy?
CVE-2023-40108 could potentially allow unauthorized access to media content belonging to another user, compromising their privacy.
Is user interaction required to exploit CVE-2023-40108?
No, user interaction is not needed for the exploitation of CVE-2023-40108.
Which software is affected by CVE-2023-40108?
CVE-2023-40108 affects multiple versions of Google Android software.