by Kastro
Paper/Archive/CVE-2023-21403

CVE-2023-21403

Google Android — In RGXDestroyZSBufferKM of rgxta3d.c, there is a possible arbitrary code execution due to an uncaught exception.

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 35.7.357 × 207.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In RGXDestroyZSBufferKM of rgxta3d.c, there is a possible arbitrary code execution due to an uncaught exception. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected

ProductAffectedFixed inSource
AndroidAndroid SoC–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refsource.android.com/security/bulletin/2023-12-01