Unscored CVE-2023-35669 EUVD-2023-39669GHSA-4cx6-5w6j-4cvx

In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to control other running activities due to unsafe…

Published Sep 11, 2023 · Updated Sep 26, 2024 · Assigned by google_android

Vendor: Google Product: Android Platform: Android

Description

In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to control other running activities due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

Vendor	Product	Affected	Fixed
Google	Android	13, 12L, 12, 11	—

Advisories 2

WID-SEC-2023-2273 Google Android: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 5, 2023
WID-SEC-2023-2272 Samsung Android: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 5, 2023

References

https://android.googlesource.com/platform/frameworks/base/+/f810d81839af38ee121c446105ca67cb12992fc6
https://source.android.com/security/bulletin/2023-09-01