Unscored CVE-2023-35677 EUVD-2023-39677GHSA-6mqc-xv9m-7m85

In onCreate of DeviceAdminAdd.java, there is a possible way to forcibly add a device admin due to a missing permission check. This could le…

Published Sep 11, 2023 · Updated Oct 29, 2024 · Assigned by google_android

Vendor: Google Product: Android Platform: Android

Description

In onCreate of DeviceAdminAdd.java, there is a possible way to forcibly add a device admin due to a missing permission check. This could lead to local denial of service (factory reset or continuous locking) with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

Vendor	Product	Affected	Fixed
Google	Android	13, 12L, 12, 11	—

Advisories 2

WID-SEC-2023-2273 Google Android: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 5, 2023
WID-SEC-2023-2272 Samsung Android: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 5, 2023

References

https://android.googlesource.com/platform/packages/apps/Settings/+/846180c19f68f6fb1b0653356401d3235fef846e
https://source.android.com/security/bulletin/2023-09-01