Unscored CVE-2023-40081 EUVD-2023-44688GHSA-fg8c-5jfr-hgj7

In loadMediaDataInBgForResumption of MediaDataManager.kt, there is a possible way to view another user's images due to a confused deputy. T…

Published Dec 4, 2023 · Updated Aug 2, 2024 · Assigned by google_android

Vendor: Google Product: Android Platform: Android

Description

In loadMediaDataInBgForResumption of MediaDataManager.kt, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

Vendor	Product	Affected	Fixed
Google	Android	14, 13, 12L, 12	—

Advisories 2

WID-SEC-2024-0551 Android Patchday März BSI CERT-Bund (WID) · Jun 4, 2024
WID-SEC-2023-3057 Google Android: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 6, 2023

References

https://android.googlesource.com/platform/frameworks/base/+/6fab80f141163de4d0008f7cd081cfc4917c3c68
https://source.android.com/security/bulletin/2024-03-01