CVE-2023-40140: Use After Free

Published Oct 2, 2023

Updated

In androidviewInputDevicecreate of androidviewInputDevice.cpp, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

5 affected components

Google Android=11.0

Google Android=12.0

Google Android=12.1

Google Android=13.0

Google Android

Remediation

Patch Available

https://android.googlesource.com/platform/frameworks/base/+/2d88a5c481df8986dbba2e02c5bf82f105b36243

Event History

Oct 2, 2023

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Oct 27, 2023

CVE Published

via MITRE·08:22 PM

Data Sourced

via MITRE·08:22 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2023-40140?

CVE-2023-40140 is a vulnerability in the android_view_InputDevice_create function of the Android operating system that allows for the execution of arbitrary code.

What is the severity of CVE-2023-40140?

CVE-2023-40140 is considered to have a high severity level with a severity value of 7.

How does CVE-2023-40140 lead to privilege escalation?

CVE-2023-40140 can lead to local privilege escalation as it allows for the execution of arbitrary code without requiring additional execution privileges or user interaction.

How can I fix CVE-2023-40140?

To fix CVE-2023-40140, it is recommended to install the latest security updates provided by Google for the Android operating system.

What is CWE-416?

CWE-416 refers to a use after free vulnerability, which is the type of vulnerability present in CVE-2023-40140.