VDB
UBUNTU-CVE-2023-20938
UBUNTU-CVE-2023-20938
PUBLISHED
CVSS 6.900000095367432 MEDIUM
In binder_transaction_buffer_release of binder.c, there is a possible use after free due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-257685302References: Upstream kernel
Risk Scores
CVSS 4.0
6.900000095367432
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:Pro:18.04:LTS | linux-aws | 4.15.0-1058.60, 4.15.0-1056.58, 4.15.0-1054.56 |
| Ubuntu:18.04:LTS | linux-oem | 4.15.0-1018.21, 4.15.0-1012.15, 4.15.0-1009.12 |
| Ubuntu:20.04:LTS | linux-aws-5.11 | 5.11.0-1009.9~20.04.2, 0, 5.11.0-1028.31~20.04.1 |
| Ubuntu:Pro:FIPS:18.04:LTS | linux-azure-fips | 0, 4.15.0-1002.2 |
| Ubuntu:18.04:LTS | linux-gcp | 4.15.0-1029.31, 5.0.0-1033.34, 5.0.0-1031.32 |
| Ubuntu:Pro:14.04:LTS | linux-azure | 4.15.0-1089.99~14.04.1, 4.15.0-1103.114~14.04.1, 4.15.0-1102.113~14.04.1 |
| Ubuntu:22.04:LTS | linux-nvidia | 0, 5.15.0-1023.23, 5.15.0-1005.5 |
| Ubuntu:22.04:LTS | linux-azure | 5.15.0-1029.36, 5.15.0-1024.30, 5.15.0-1023.29 |
| Ubuntu:20.04:LTS | linux-iot | 5.4.0-1001.3, 5.4.0-1012.14, 0 |
| Ubuntu:20.04:LTS | linux-azure | 5.4.0-1101.107, 5.4.0-1103.109, 5.4.0-1100.106 |
| Ubuntu:22.04:LTS | linux-ibm | 5.15.0-1015.17, 5.15.0-1017.20, 5.15.0-1018.21 |
| Ubuntu:Pro:Realtime:22.04:LTS | linux-realtime | 0, 5.15.0-1006.6, 5.15.0-1015.15 |
| Ubuntu:20.04:LTS | linux-gcp | 5.4.0-1089.97, 5.4.0-1078.84, 5.4.0-1080.87 |
| Ubuntu:18.04:LTS | linux-oracle-5.4 | 5.4.0-1043.46~18.04.1, 5.4.0-1042.45~18.04.1, 5.4.0-1041.44~18.04.1 |
| Ubuntu:18.04:LTS | linux-azure-5.4 | 5.4.0-1056.58~18.04.1, 5.4.0-1059.62~18.04.1, 5.4.0-1058.60~18.04.1 |
| Ubuntu:20.04:LTS | linux-gkeop-5.15 | 5.15.0-1013.17~20.04.1, 5.15.0-1012.16~20.04.1, 5.15.0-1011.15~20.04.2 |
| Ubuntu:20.04:LTS | linux-xilinx-zynqmp | 5.4.0-1021.25, 5.4.0-1020.24, 0 |
| Ubuntu:18.04:LTS | linux-aws-5.0 | 5.0.0-1025.28, 5.0.0-1024.27~18.04.1, 5.0.0-1023.26~18.04.1 |
| Ubuntu:Pro:16.04:LTS | linux-kvm | 4.4.0-1070.77, 4.4.0-1071.78, 4.4.0-1075.82 |
| Ubuntu:Pro:16.04:LTS | linux-hwe | 4.15.0-189.200~16.04.1, 4.15.0-235.247~16.04.1, 4.15.0-234.246~16.04.1 |
…and 109 more
Timeline
- Feb 28, 2023 CVE Published
- Oct 28, 2026 CVE Updated
- Oct 31, 2026 Distribution Patch
- Oct 31, 2026 Distribution Patch
- Oct 31, 2026 Distribution Patch
- Oct 31, 2026 Distribution Patch
- Oct 31, 2026 Distribution Patch
- Oct 31, 2026 Distribution Patch
- Oct 31, 2026 Distribution Patch
- Oct 31, 2026 Distribution Patch
- Oct 31, 2026 Distribution Patch
- Oct 31, 2026 Distribution Patch
References
- https://ubuntu.com/security/CVE-2023-20938 report
- https://source.android.com/docs/security/bulletin/2023-02-01 report
- https://ubuntu.com/security/notices/USN-5917-1 advisory
- https://ubuntu.com/security/notices/USN-5934-1 advisory
- https://ubuntu.com/security/notices/USN-5939-1 advisory
- https://ubuntu.com/security/notices/USN-5940-1 advisory
- https://ubuntu.com/security/notices/USN-5951-1 advisory
- https://ubuntu.com/security/notices/USN-6000-1 advisory
- https://ubuntu.com/security/notices/USN-6080-1 advisory
- https://ubuntu.com/security/notices/USN-6085-1 advisory
- https://ubuntu.com/security/notices/USN-6090-1 advisory
- https://ubuntu.com/security/notices/USN-6133-1 advisory
- https://ubuntu.com/security/notices/USN-6134-1 advisory
- https://www.cve.org/CVERecord?id=CVE-2023-20938 report