Unscored CVE-2023-35667 EUVD-2023-39667GHSA-p95j-356c-hgx2

In updateList of NotificationAccessSettings.java, there is a possible way to hide approved notification listeners in the settings due to a …

Published Sep 11, 2023 · Updated Sep 26, 2024 · Assigned by google_android

Vendor: Google Product: Android Platform: Android

Description

In updateList of NotificationAccessSettings.java, there is a possible way to hide approved notification listeners in the settings due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

Vendor	Product	Affected	Fixed
Google	Android	13, 12L, 12, 11	—

Advisories 2

WID-SEC-2023-2273 Google Android: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 5, 2023
WID-SEC-2023-2272 Samsung Android: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 5, 2023

References

https://android.googlesource.com/platform/packages/apps/Settings/+/d8355ac47e068ad20c6a7b1602e72f0585ec0085
https://source.android.com/security/bulletin/2023-09-01