Headline
CVE-2023-35674
In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
)]}’ { "commit": "7428962d3b064ce1122809d87af65099d1129c9e", "tree": "1deeadc22093f2abd0eb83df703d39bb3ebd04d5", "parents": [ “375227708b825b70a1b50f0feb0355036d0058fb” ], "author": { "name": "Achim Thesmann", "email": "[email protected]", "time": “Tue May 23 00:26:33 2023 +0000” }, "committer": { "name": "Android Build Coastguard Worker", "email": "[email protected]", "time": “Fri Jul 14 17:30:03 2023 +0000” }, "message": "Ignore virtual presentation windows - RESTRICT AUTOMERGE\n\nWindows of TYPE_PRESENTATION on virtual displays should not be counted\nas visible windows to determine if BAL is allowed.\n\nTest: manual test, atest BackgroundActivityLaunchTest\nBug: 264029851, 205130886\n(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:4c40b187cd5277c27d20758c675865bf89180c7a)\n(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:5bf9607bec3f1224158cfcff7dd91ac558b46c0f)\nMerged-In: I08b16ba1c155e951286ddc22019180cbd6334dfa\nChange-Id: I08b16ba1c155e951286ddc22019180cbd6334dfa\n", "tree_diff": [ { "type": "modify", "old_id": "4c32edc6d709debe9792f88c5680652a38d4c5ce", "old_mode": 33188, "old_path": "services/core/java/com/android/server/wm/WindowState.java", "new_id": "8a14c93c1d3844e8fe9a705f688ef2934404b4d9", "new_mode": 33188, "new_path": “services/core/java/com/android/server/wm/WindowState.java” } ] }
Related news
Plus: Mozilla patches 10 Firefox bugs, Cisco fixes a vulnerability with a rare maximum severity score, and SAP releases updates to stamp out three highly critical flaws.
In avdt_msg_asmbl of avdt_msg.cc, there is a possible out of bounds write due to an integer overflow. This could lead to paired device escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Google has rolled out monthly security patches for Android to address a number of flaws, including a zero-day bug that it said may have been exploited in the wild. Tracked as CVE-2023-35674, the high-severity vulnerability is described as a case of privilege escalation impacting the Android Framework. “There are indications that CVE-2023-35674 may be under limited, targeted exploitation,” the