GSD-2023-21290 | Vulnetix

GSD-2023-21290 PUBLISHED

Record from circl · Published November 28, 2020

In update of MmsProvider.java, there is a possible way to bypass file permission checks due to a race condition. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

Vendor	Product	Versions
Google	Android	13, 12L, 12

Timeline

Nov 28, 2020 CVE Published

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GSD-2023-21290
vulnetix vdb fixes GSD-2023-21290

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GSD-2023-21290/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

https://source.android.com/security/bulletin/2023-08-01 url
https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ca4c9a19635119d95900793e7a41b820cd1d94d9 url

Look up in the Resolve Platform →