CVE-2023-20911

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In addPermission of PermissionManagerServiceImpl.java , there is a possible failure to persist permission settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-242537498

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
n/a	Android	Android-11 Android-12 Android-12L Android-13

References

https://source.android.com/security/bulletin/2023-03-01Patch, Vendor Advisory
https://source.android.com/security/bulletin/2023-03-01Patch, Vendor Advisory

Timeline

Published: Mar 24, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-209127.8In onActivityResult of AvatarPickerActivity.java, there is a possible way to access images belonging to other users due to a missing permiss CVE-2023-209137.8In onCreate of PhoneAccountSettingsActivity.java and related files, there is a possible way to mislead the user into enabling a malicious ph CVE-2023-209145.5In onSetRuntimePermissionGrantStateByDeviceAdmin of AdminRestrictedPermissionsUtils.java, there is a possible way for the work profile to re CVE-2023-209157.8In addOrReplacePhoneAccount of PhoneAccountRegistrar.java, there is a possible way to enable a phone account without user interaction due to CVE-2023-209167.8In getMainActivityLaunchIntent of LauncherAppsService.java, there is a possible way to bypass the restrictions on starting activities from t CVE-2023-209177.8In onTargetSelected of ResolverActivity.java, there is a possible way to share a wrong file due to a logic error in the code. This could lea CVE-2023-209189.8In getPendingIntentLaunchFlags of ActivityOptions.java, there is a possible elevation of privilege due to a confused deputy with no addition CVE-2023-209197.8In getStringsForPrefix of Settings.java, there is a possible prevention of package uninstallation due to a logic error in the code. This cou CVE-2023-20929.8A vulnerability, which was classified as critical, has been found in SourceCodester Vehicle Service Management System 1.0. Affected by this CVE-2023-209207.8In queue of UsbRequest.java, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privi CVE-2023-209217.3In onPackageRemoved of AccessibilityManagerService.java, there is a possibility to automatically grant accessibility services due to a logic CVE-2023-209225.5In setMimeGroup of PackageManagerService.java, there is a possible crash loop due to resource exhaustion. This could lead to local denial of