CVE-2023-21229

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In registerServiceLocked of ManagedServices.java, there is a possible bypass of background activity launch restrictions due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Aug 14, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-21236.1The WP Inventory Manager WordPress plugin before 2.1.0.13 does not sanitise and escape a parameter before outputting it back in the page, leCVE-2023-212305.5In onAccessPointChanged of AccessPointPreference.java, there is a possible way for unprivileged apps to receive a broadcast about WiFi accesCVE-2023-212317.8In getIntentForButton of ButtonManager.java, there is a possible way for an unprivileged application to start a non-exported or permission-pCVE-2023-212323.3In multiple locations, there is a possible way to retrieve sensor data without permissions due to a permissions bypass. This could lead to lCVE-2023-212337.5In multiple locations of avrc, there is a possible leak of heap data due to uninitialized data. This could lead to remote information discloCVE-2023-212345.5In launchConfirmationActivity of ChooseLockSettingsHelper.java, there is a possible way to enable developer options without the lockscreen PCVE-2023-212357.8In onCreate of LockSettingsActivity.java, there is a possible way set a new lockscreen PIN without entering the existing PIN due to a permisCVE-2023-212366.7In aoc_service_set_read_blocked of aoc.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local esCVE-2023-212375.5In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading orCVE-2023-212385.5In visitUris of RemoteViews.java, there is a possible leak of images between users due to a confused deputy. This could lead to local informCVE-2023-212395.5In visitUris of Notification.java, there is a possible way to leak image data across user boundaries due to a confused deputy. This could leCVE-2023-21247.8An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with