CVE-2023-20941

2023-04-1920:15:11

Debian Security Bug Tracker

security-tracker.debian.org

android

acc_ctrlrequest_composite

out of bounds write

physical escalation

privilege escalation

user interaction

upstream kernel

unix

6.6 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.0005 Low

EPSS

Percentile

17.6%

JSON

In acc_ctrlrequest_composite of f_accessory.c, there is a possible out of bounds write due to a missing bounds check. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-264029575References: Upstream kernel

OSVersionArchitecturePackageVersionFilename
Debian12alllinux< 6.1.94-1linux_6.1.94-1_all.deb
Debian11alllinux< 5.10.218-1linux_5.10.218-1_all.deb
Debian999alllinux< 6.9.7-1linux_6.9.7-1_all.deb
Debian13alllinux< 6.9.7-1linux_6.9.7-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	linux	< 6.1.94-1	linux_6.1.94-1_all.deb
Debian	11	all	linux	< 5.10.218-1	linux_5.10.218-1_all.deb
Debian	999	all	linux	< 6.9.7-1	linux_6.9.7-1_all.deb
Debian	13	all	linux	< 6.9.7-1	linux_6.9.7-1_all.deb