CVE-2023-40123: PipMode actions could render icons with unauthorized URIs in Android's platform/frameworks/base
Summary
CVE-2023-40123: In updateActionViews of PipMenuView.java, there is a possible bypass of a multi user security boundary due to a confused deputy. Affects platform/frameworks/base across 4 version ranges.
>= 11:0, < 11:2023-10-01
>= 12:0, < 12:2023-10-01
>= 12L:0, < 12L:2023-10-01
>= 13:0, < 13:2023-10-01
Fixed in 11:2023-10-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'platform/frameworks/base' is a fundamental component of the Android operating system. It provides core functionalities and services for the Android framework, including the user interface, system services, and various APIs. This package is responsible for managing the behavior and appearance of the Android system, ensuring proper functioning and security. However, a vulnerability has been discovered in this package that allows unauthorized rendering of icons with URIs in PipMode actions.
Vulnerability Detail
The vulnerability arises from a flaw in the 'PipMenuView.java' file's 'updateActionViews' function. It enables a bypass of the multi-user security boundary, leading to potential local information disclosure without requiring additional execution privileges. Exploitation of this vulnerability does not require user interaction. An attacker could leverage this vulnerability to access unauthorized URIs and potentially obtain sensitive information from other users or applications on the device.
How To Fix
Minimum fixed version
11:2023-10-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
In conclusion, the 'platform/frameworks/base' package in Android is vulnerable to unauthorized rendering of icons with URIs in PipMode actions. This vulnerability could lead to local information disclosure without requiring additional execution privileges. It is crucial to apply the provided fix from the AOSP to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
This vulnerability could lead to local information disclosure, allowing unauthorized access to URIs and potential exposure of sensitive data.
No, exploitation of this vulnerability does not require user interaction.
The vulnerability was introduced in Android 11 and affects all subsequent versions up to Android 13.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
Yes, a fix has been provided by the Android Open Source Project (AOSP) and should be applied to affected devices.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
