Privilege escalation in Android Automotive OS

1) Input validation error

EUVDB-ID: #VU77992

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-21260

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to insufficient validation of user-supplied input. A malicious application can embed a service label that overflow the original user prompt and possibly contain mis-leading information as a system message for user confirmation.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Android Automotive OS (AAOS): before 11 2023-07-01

CPE2.3

• cpe:2.3:o:google:aaos:*:*:*:*:*:*:*:*

External links

https://source.android.com/docs/security/bulletin/aaos/2023-07-01

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.