In resetSettingsLocked of SettingsProvider.java, there is a possible lockscreen bypass due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00006.

Exploitation none

Automatable no

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Google Android unaffected
Version Status Constraints
13 affected
—
12L affected
—
12 affected
—
11 affected
—

Configuration 1 [-]

OR cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:12.1:*:*:*:*:*:*:*
cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*

No data.

No data.

Subscriptions

Vendors Products
Google Subscribe
Android Subscribe

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-44724 In resetSettingsLocked of SettingsProvider.java, there is a possible lockscreen bypass due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://android.googlesource.com/platform/frameworks/base/+/ff86ff28cf82124f8e65833a2dd8c319aea08945 cve-icon cve-icon
https://android.googlesource.com/platform/packages/apps/Settings/+/11815817de2f2d70fe842b108356a1bc75d44ffb cve-icon cve-icon
https://source.android.com/security/bulletin/2023-10-01 cve-icon cve-icon
History

Tue, 29 Apr 2025 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 29 Apr 2025 20:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-863
cve-icon MITRE

Status: PUBLISHED

Assigner: google_android

Published:

Updated: 2025-04-29T19:59:46.887Z

Reserved: 2023-08-09T02:29:31.890Z

Link: CVE-2023-40117

cve-icon Vulnrichment

Updated: 2024-08-02T18:24:55.621Z

cve-icon NVD

Status : Modified

Published: 2023-10-27T21:15:08.620

Modified: 2025-04-29T20:15:24.663

Link: CVE-2023-40117

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses