CVE-2023-44123 : Security Advisory and Response

A critical vulnerability has been identified in the Bluetooth app of LG V60 Thin Q 5G smartphones running Android 12 and 13. The vulnerability allows attackers to hijack a privileged process via PendingIntent hijacking, potentially leading to the theft and overwriting of arbitrary files with system privileges.

Understanding CVE-2023-44123

This section delves into the details of the CVE-2023-44123 vulnerability.

What is CVE-2023-44123?

The vulnerability involves the use of implicit PendingIntents with the PendingIntent.FLAG_MUTABLE set in the Bluetooth app, enabling attackers to intercept notifications and redirect them to their malicious activities. This action can grant access permissions to content providers with the

android:grantUriPermissions="true"

flag.

The Impact of CVE-2023-44123

The impact of this vulnerability is categorized as 'Hijacking a privileged process' according to CAPEC-234. Attackers can leverage this flaw to gain unauthorized access to sensitive files and data, posing a severe threat to user privacy and system security.

Technical Details of CVE-2023-44123

In this section, we explore the technical aspects of CVE-2023-44123.

Vulnerability Description

The vulnerability arises from the use of implicit PendingIntents with the FLAG_MUTABLE set, allowing attackers to manipulate system privileges and perform unauthorized file operations within the Bluetooth app.

Affected Systems and Versions

LG V60 Thin Q 5G devices running Android 12 and 13 are impacted by this vulnerability, exposing them to potential exploitation.

Exploitation Mechanism

Attackers can exploit this vulnerability by intercepting notifications in the Bluetooth app and manipulating access permissions to gain unauthorized control over system resources.

Mitigation and Prevention

To safeguard devices from CVE-2023-44123, immediate actions and long-term security practices are essential.

Immediate Steps to Take

Users are advised to update their LG V60 Thin Q 5G devices to the latest patches released by LG Electronics. Additionally, exercise caution while granting permissions to apps and review app notification settings.

Long-Term Security Practices

Implement security best practices such as avoiding untrusted sources, configuring app permissions judiciously, and regularly updating the device and apps to address potential security vulnerabilities.

Patching and Updates

LG Electronics has released security advisories and patches addressing the CVE-2023-44123 vulnerability. Users should promptly install these updates to mitigate the risk of exploitation.