CVE-2023-44123: Bluetooth - Theft and (over-)write of arbitrary files with system privilege via PendingIntent hijacking
The vulnerability is the use of implicit PendingIntents with the PendingIntent.FLAGMUTABLE set that leads to theft and/or (over-)write of arbitrary files with system privilege in the Bluetooth ("com.lge.bluetoothsetting") app. The attacker's app, if it had access to app notifications, could intercept them and redirect them to its activity, before making it grant access permissions to content providers with the android:grantUriPermissions="true" flag.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-44123?
CVE-2023-44123 is a vulnerability in the Bluetooth app on Google Android and LG V60 Thin Q 5g devices that allows an attacker's app to steal or overwrite arbitrary files with system privileges.
How does CVE-2023-44123 affect Google Android and LG V60 Thin Q 5g devices?
CVE-2023-44123 affects Google Android versions 12.0 and 13.0, allowing an attacker's app to intercept app notifications and potentially steal or overwrite files with system privileges. LG V60 Thin Q 5g is not vulnerable to this specific issue.
What is the severity of CVE-2023-44123?
CVE-2023-44123 has a severity rating of 7.8, which is considered high.
How can CVE-2023-44123 be mitigated?
To mitigate CVE-2023-44123, users should update their Google Android devices to the latest available version and apply any patches or security updates provided by their device manufacturer.
Where can I find more information about CVE-2023-44123?
More information about CVE-2023-44123 can be found in the LG Security Bulletins on the LG website.