CVE-2023-21270

Google / Andrioid PUBLISHED

Description (CNA)

In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way for an app to keep permissions that should be revoked due to incorrect permission flags cleared during an update. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

Affected (CNA)

Vendor / product	Versions
Google / Andrioid	affected sc-dev; affected sc-v2-dev; affected tm-dev

CWE

No CWE identifiers supplied.

References

https://source.android.com/security/bulletin/2023-08-01

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.