Lucene search

GoogleOSV:ASB-A-280793427

HistorySep 01, 2023 - 12:00 a.m.

EoP: Default IME to Device Administrator

2023-09-0100:00:00

Google

osv.dev

eop

device administrator

oncreate

missing permission check

local denial of service

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

In onCreate of DeviceAdminAdd.java, there is a possible way to forcibly add a device admin due to a missing permission check. This could lead to local denial of service (factory reset or continuous locking) with no additional execution privileges needed. User interaction is not needed for exploitation.

CPENameOperatorVersion
platform/packages/apps/settingseq12L
platform/packages/apps/settingseq11
platform/packages/apps/settingseq12
platform/packages/apps/settingseq13

Name	Operator	Version
platform/packages/apps/settings	eq	12L
platform/packages/apps/settings	eq	11
platform/packages/apps/settings	eq	12
platform/packages/apps/settings	eq	13

References

android.googlesource.com/platform/packages/apps/Settings/+/846180c19f68f6fb1b0653356401d3235fef846e

source.android.com/security/bulletin/2023-09-01

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for OSV:ASB-A-280793427