CVE-2023-21089
Last modified
CVE-2023-21089 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In startInstrumentation of ActivityManagerService.java, there is a possible way to keep the foreground service alive while the app is in the background. This could lead to local escalation of privilege with no additional execution privileges needed. EPSS estimates a 0.09% chance of exploitation in the next 30 days.
Description
In startInstrumentation of ActivityManagerService.java, there is a possible way to keep the foreground service alive while the app is in the background. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-237766679
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Android | 11.0 | |
| Android | 12.0 | |
| Android | 12.1 | |
| Android | 13.0 |
References
- https://source.android.com/security/bulletin/2023-04-01Patch, Vendor Advisory
- https://source.android.com/security/bulletin/2023-04-01Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-21089?
How severe is CVE-2023-21089?
How do I fix CVE-2023-21089?
Are you affected by CVE-2023-21089?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST