CVE-2023-21017

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In InstallStart of InstallStart.java, there is a possible way to change the installer package name due to an improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-236687884

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	Android	Android-13

References

https://source.android.com/security/bulletin/pixel/2023-03-01Patch, Vendor Advisory
https://source.android.com/security/bulletin/pixel/2023-03-01Patch, Vendor Advisory

Timeline

Published: Mar 24, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-210186.7In UnwindingWorker of unwinding.cc, there is a possible out of bounds write due to a use after free. This could lead to local escalation of CVE-2023-210195.5In ih264e_init_proc_ctxt of ih264e_process.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local CVE-2023-21024.8Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.CVE-2023-210206.7In registerSignalHandlers of main.c, there is a possible local arbitrary code execution due to a use after free. This could lead to local es CVE-2023-210217.8In isTargetSdkLessThanQOrPrivileged of WifiServiceImpl.java, there is a possible way for the guest user to change admin user network setting CVE-2023-210227.8In BufferBlock of Suballocation.cpp, there is a possible out of bounds write due to memory corruption. This could lead to local escalation o CVE-2023-210247.8In maybeFinish of FallbackHome.java, there is a possible delay of lockdown screen due to logic error. This could lead to local escalation of CVE-2023-210254.4In ufdt_local_fixup_prop of ufdt_overlay.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to loca CVE-2023-210265.5In updateInputChannel of WindowManagerService.java, there is a possible way to set a touchable region beyond its own SurfaceControl due to a CVE-2023-210277.5In multiple functions of PasspointXmlUtils.java, there is a possible authentication misconfiguration due to a logic error in the code. This CVE-2023-210287.5In parse_printerAttributes of ipphelper.c, there is a possible out of bounds read due to a string without a null-terminator. This could lead CVE-2023-210295.5In register of UidObserverController.java, there is a missing permission check. This could lead to local information disclosure of app usage