CVE-2023-49794

Katalog CVE

CVSS 7.8 · High EPSS 0,25%

Kerentanan Authentication Bypass by Spoofing pada kernelsu. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

KernelSU is a Kernel-based root solution for Android devices. In versions 0.7.1 and prior, the logic of get apk path in KernelSU kernel module can be bypassed, which causes any malicious apk named `me.weishu.kernelsu` get root permission. If a KernelSU module installed device try to install any not checked apk which package name equal to the official KernelSU Manager, it can take over root privileges on the device. As of time of publication, a patched version is not available.

Rincian

Terbit di NVD

2 Januari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-290: Authentication Bypass by Spoofing

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tiann/KernelSU/security/advisories/GHSA-8rc5-x54x-5qc4 exploit · advisory vendor
• https://drive.google.com/file/d/1b9UrmG_co9EJXB_yMBneRArUIR5sTuaN/view?usp=drive_link product