ASB-A-257954050

See a problem?

Import Source

https://storage.googleapis.com/android-osv/ASB-A-257954050.json

JSON Data

https://api.osv.dev/v1/vulns/ASB-A-257954050

Aliases

A-257954050
CVE-2023-21091

Published

2023-04-01T00:00:00Z

Modified

2026-04-17T15:55:28.020024Z

Summary

[none]

Details

In canDisplayLocalUi of AppLocalePickerActivity.java, there is a possible way to change system app locales due to a missing permission check. This could lead to local denial of service across user boundaries with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/packages/apps/Settings

Package

Name: platform/packages/apps/Settings

Affected ranges

Type: ECOSYSTEM
Events: Introduced

13-next:0

Fixed

13-next:2023-04-01

Affected versions

Other

13-next

Ecosystem specific

{
    "severity": "High",
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/Settings/+/ed9cbdea18c532a1264bfe7e4043496059e1e5fd"
    ],
    "spl": "2023-04-01",
    "vanir_signatures": [
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/ed9cbdea18c532a1264bfe7e4043496059e1e5fd",
            "target": {
                "file": "src/com/android/settings/localepicker/AppLocalePickerActivity.java"
            },
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "166050417202853291701751339784057791791",
                    "199979913566983760122768267456903554462",
                    "189924521193495092609515074354735996291",
                    "116243438245727173131782871328633947081",
                    "4804168085541400234835857522753479322",
                    "110681149833535123982358261489811169555",
                    "17892716231854941928447848842989604752",
                    "192315469113083916891583938974578089706",
                    "38316968045572558241649475757631654873",
                    "84766275637447259059812531520649854439",
                    "222539472553025219923603023730158880274",
                    "93729298876976084149185093781009605841",
                    "60311274904798221900252526941281947497",
                    "48184161827913377360016065589221965881",
                    "19702977024012449088900035296716362127",
                    "150448211190717172863285810657828192554",
                    "134484519965543013623848411296268696820",
                    "308239576561945886121920637427829306355",
                    "262894840504648576812598287353762829208"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line",
            "id": "ASB-A-257954050-0ef27ced"
        },
        {
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/ed9cbdea18c532a1264bfe7e4043496059e1e5fd",
            "target": {
                "function": "onCreate",
                "file": "src/com/android/settings/localepicker/AppLocalePickerActivity.java"
            },
            "deprecated": false,
            "digest": {
                "function_hash": "328124894360867882052371090196316249512",
                "length": 1001.0
            },
            "signature_type": "Function",
            "id": "ASB-A-257954050-a5c19189"
        }
    ],
    "types": [
        "DoS"
    ]
}

Database specific

source

"https://storage.googleapis.com/android-osv/ASB-A-257954050.json"