Lucene search

LGECVELIST:CVE-2023-44125

HistorySep 27, 2023 - 1:59 p.m.

CVE-2023-44125 Personalized service - Theft and (over-)write of arbitrary files with system privilege via PendingIntent hijacking

2023-09-2713:59:02

CWE-285

LGE

www.cve.org

cve-2023-44125

theft

over-write

arbitrary files

system privilege

com.lge.abba" app

pendingintents

access permissions

android:granturipermissions="true

CVSS3

6.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS

0.001

Percentile

17.0%

JSON

The vulnerability is the use of implicit PendingIntents without the PendingIntent.FLAG_IMMUTABLE set that leads to theft and/or (over-)write of arbitrary files with system privilege in the Personalized service (“com.lge.abba”) app. The attacker’s app, if it had access to app notifications, could intercept them and redirect them to its activity, before making it grant access permissions to content providers with the android:grantUriPermissions="true" flag.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "LG V60 Thin Q 5G(LMV600VM)",
    "vendor": "LG Electronics",
    "versions": [
      {
        "status": "affected",
        "version": "Android 12, 13"
      }
    ]
  }
]

References

lgsecurity.lge.com/bulletins/mobile#updateDetails