CVE-2023-21165

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In DevmemIntUnmapPMR of devicemem_server.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Feb 16, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-211669.8In RGXBackingZSBuffer of rgxta3d.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalatioCVE-2023-211675.5In setProfileName of DevicePolicyManagerService.java, there is a possible way to crash the SystemUI menu due to a missing bounds check. ThisCVE-2023-211685.5In convertCbYCrY of ColorConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local inforCVE-2023-211694.4In inviteInternal of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local informatiCVE-2023-21172.7The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, aCVE-2023-211704.4In executeSetClientTarget of ComposerCommandEngine.h, there is a possible out of bounds read due to a missing bounds check. This could lead CVE-2023-211716.7In verifyInputEvent of InputDispatcher.cpp, there is a possible way to conduct click fraud due to side channel information disclosure. This CVE-2023-211727.8In multiple functions of WifiCallingSettings.java, there is a possible way to change calling preferences for the admin user due to a permissCVE-2023-211735.5In multiple methods of DataUsageList.java, there is a possible way to learn about admin user's network activities due to a missing permissioCVE-2023-211747.8In isPageSearchEnabled of BillingCycleSettings.java, there is a possible way for the guest user to change data limits due to a permissions bCVE-2023-211757.8In onCreate of DataUsageSummary.java, there is a possible method for a guest user to enable or disable mobile data due to a permissions bypaCVE-2023-211764.4In list_key_entries of utils.rs, there is a possible way to disable user credentials due to resource exhaustion. This could lead to local de
CVE-2023-21165: High severity, CVSS 7.8 | Vulnix