by Kastro
Paper/Archive/CVE-2023-21163

CVE-2023-21163

Google Android — In PMR_ReadBytes of pmr.c, there is a possible arbitrary code execution due to a use after free.

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 35.7.357 × 207.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In PMR_ReadBytes of pmr.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected

ProductAffectedFixed inSource
AndroidAndroid SoC–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refsource.android.com/security/bulletin/2023-12-01