ASB-A-262892300

See a problem?

Import Source

https://storage.googleapis.com/android-osv/ASB-A-262892300.json

JSON Data

https://api.osv.dev/v1/vulns/ASB-A-262892300

Aliases

A-262892300
CVE-2023-21084

Published

2023-04-01T00:00:00Z

Modified

2024-08-07T19:30:05.048093Z

Summary

Use sha256 for hashing Microdroid system/vendor image (for vbmeta descriptor) | Currently using sha1

Details

In buildPropFile of filesystem.go, there is a possible insecure hash due to an improperly used crypto. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/build/soong

Package

Name: platform/build/soong

Affected ranges

Type: ECOSYSTEM
Events: Introduced

13:0

Fixed

13:2023-04-01

Affected versions

Other

Ecosystem specific

{
    "fixes": [
        "https://android.googlesource.com/platform/build/soong/+/f3d1e8c24cba69b93d9fdd2f01d770927988eeb1"
    ],
    "spl": "2023-04-01",
    "severity": "High",
    "types": [
        "EoP"
    ]
}

Android / platform/packages/modules/Virtualization

Package

Name: platform/packages/modules/Virtualization

Affected ranges

Type: ECOSYSTEM
Events: Introduced

13:0

Fixed

13:2023-04-01

Affected versions

Other

Ecosystem specific

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/Virtualization/+/94d7faa228c828abbbfda212f2e4abfa27d00b25"
    ],
    "spl": "2023-04-01",
    "severity": "High",
    "types": [
        "EoP"
    ]
}