CVE-2023-40082 : In modify_for_next_stage of fdt.rs, there is a possible way to render KASLR inef

In modify_for_next_stage of fdt.rs, there is a possible way to render KASLR ineffective due to improperly used crypto. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Published 2023-12-04 23:15:24

Updated 2024-02-15 20:46:12

Source Android (associated with Google Inc. or Open Handset Alliance)

View at NVD, CVE.org

Products affected by CVE-2023-40082

Google » Android » Version: 14.0
cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-40082

EPSS FAQ

0.16%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 52 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-40082

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2023-40082

https://source.android.com/security/bulletin/2023-12-01

Android Security Bulletin—December 2023 | Android Open Source Project
Patch;Third Party Advisory

CVEs referencing this url
https://android.googlesource.com/platform/packages/modules/Virtualization/+/0cf463e9949db2d30755fc63a79225a6158928d3

0cf463e9949db2d30755fc63a79225a6158928d3 - platform/packages/modules/Virtualization - Git at Google
Mailing List;Patch

Jump to

Vulnerability Details : CVE-2023-40082

Products affected by CVE-2023-40082

Exploit prediction scoring system (EPSS) score for CVE-2023-40082

CVSS scores for CVE-2023-40082

References for CVE-2023-40082