CVE-2023-48409

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In gpu_pixel_handle_buffer_liveness_update_ioctl of private/google-modules/gpu/mali_kbase/mali_kbase_core_linux.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

No affected versions have been published.

Timeline

Published: Dec 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-48415.4The Feeds for YouTube plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'youtube-feed' shortcode in versions up to, and CVE-2023-484107.5In cd_ParseMsg of cd_codec.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information di CVE-2023-484115.5In SignalStrengthAdapter::FillGsmSignalStrength() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds CVE-2023-484125.5In private_handle_t of mali_gralloc_buffer.h, there is a possible information leak due to a logic error in the code. This could lead to loc CVE-2023-484134.9In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote informati CVE-2023-484146.7In the Pixel Camera Driver, there is a possible use after free due to a logic error in the code. This could lead to local escalation of priv CVE-2023-484155.5In Init of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local informat CVE-2023-484167.5In multiple locations, there is a possible null dereference due to a missing null check. This could lead to remote denial of service with no CVE-2023-484179.8Missing Permission checks resulting in unauthorized access and Manipulation in KeyChainActivity Application CVE-2023-484187.8In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecur CVE-2023-484199.8An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in Elevation of Privilege CVE-2023-48425.4The Social Sharing Plugin - Social Warfare plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'social_warfare' shortcode