PUB-A-222287335

See a problem?

Import Source

https://storage.googleapis.com/android-osv/PUB-A-222287335.json

JSON Data

https://api.osv.dev/v1/vulns/PUB-A-222287335

Aliases

A-222287335
CVE-2023-21176

Published

2023-06-01T00:00:00Z

Modified

2024-08-29T06:57:57.715596Z

Summary

Disable user credentials permanently by flooding unlimited user credentials into KeyChain

Details

In listkeyentries of utils.rs, there is a possible way to disable user credentials due to resource exhaustion. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation.

References

https://source.android.com/security/bulletin/2023-06-01

Affected packages

Android / platform/system/security

Package

Name: platform/system/security

Affected ranges

Type: ECOSYSTEM
Events: Introduced

13-next:0

Fixed

13-next:2023-06-01

Affected versions

Other

13-next

Ecosystem specific

{
    "fixes": [
        "https://android.googlesource.com/platform/system/security/+/1be9d2754cf955011c0e0cdb32fecde8883bb6e6"
    ],
    "spl": "2023-06-01",
    "severity": "Moderate",
    "types": [
        "DoS"
    ]
}