5
CVE-2023-44128
- EPSS 0.02%
- Veröffentlicht 27.09.2023 15:19:37
- Zuletzt bearbeitet 21.11.2024 08:25:18
- Quelle product.security@lge.com
- CVE-Watchlists
- Unerledigt
Loginhe vulnerability is to delete arbitrary files in LGInstallService ("com.lge.lginstallservies") app. The app contains the exported "com.lge.lginstallservies.InstallService" service that exposes an AIDL interface. All its "installPackage*" methods are finally calling the "installPackageVerify()" method that performs signature validation after the delete file method. An attacker can control conditions so this security check is never performed and an attacker-controlled file is deleted.Daten sind bereitgestellt durch National Vulnerability Database (NVD)
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.02% | 0.047 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 3.6 | 1 | 2.5 |
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
|
| product.security@lge.com | 5 | 1.8 | 2.7 |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:L
|
CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.