CVE-2023-21017
In InstallStart of InstallStart.java, there is a possible way to change the installer package name due to an improper input validation. This could lea...
Original description
The description as published by the source.
In InstallStart of InstallStart.java, there is a possible way to change the installer package name due to an improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
Affected packages
Android
platform/frameworks/base
[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-03-01"}]}]
References
- advisory source.android.com
- patch android.googlesource.com