CVE-2023-45777
First published: Mon Dec 04 2023(Updated: )
In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to launch arbitrary activities using system privileges due to Parcel Mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Credit: security@android.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Google Android | ||
| Google Android | =13.0 | |
| Google Android | =14.0 |
Remedy
https://android.googlesource.com/platform/frameworks/base/+/f4644b55d36a549710ba35b6fb797ba744807da6
Remedy
https://android.googlesource.com/platform/frameworks/base/+/f810d81839af38ee121c446105ca67cb12992fc6
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://android.googlesource.com/platform/frameworks/base/+/f810d81839af38ee121c446105ca67cb12992fc6
- https://android.googlesource.com/platform/frameworks/base/+/f4644b55d36a549710ba35b6fb797ba744807da6
- https://source.android.com/docs/security/bulletin/2023-12-01 (Advisory)
- https://source.android.com/security/bulletin/2023-12-01
Frequently Asked Questions
What is the severity of CVE-2023-45777?
The severity of CVE-2023-45777 is high.
How can an arbitrary activity be launched using CVE-2023-45777?
An arbitrary activity can be launched using CVE-2023-45777 due to Parcel Mismatch.
Does the exploit require user interaction?
No, user interaction is not needed for the exploit of CVE-2023-45777.
What is the affected software for CVE-2023-45777?
The affected software for CVE-2023-45777 is Google Android.
How can I fix CVE-2023-45777?
To fix CVE-2023-45777, it is recommended to apply the security patches provided by Google.
- collector/mitre-cve
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/severity
- agent/references
- agent/author
- agent/event
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/remedy
- agent/tags
- collector/android-source
- source/Android
- agent/software-canonical-lookup-request
- vendor/google
- canonical/google android
- version/google android/13.0
- version/google android/14.0