Vulnerability · Published Sep 27, 2023 · Assigned by LGE

CVE-2023-44122LockScreenSettings - Theft arbitrary files with system privilege

Medium 6.1

In plain English

A medium-severity security flaw in LG V60 Thin Q 5G(LMV600VM) from LG Electronics. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.1%top 99.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The vulnerability is to theft of arbitrary files with system privilege in the LockScreenSettings ("com.lge.lockscreensettings") app in the "com/lge/lockscreensettings/dynamicwallpaper/MyCategoryGuideActivity.java" file. The main problem is that the app launches implicit intents that can be intercepted by third-party apps installed on the same device. They also can return arbitrary data that will be passed to the "onActivityResult()" method. The LockScreenSettings app copies the received file to the "/data/shared/dw/mycategory/wallpaper_01.png" path and then changes the file access mode to world-readable and world-writable.

Affected products (as reported)

Vendor	Product	Versions
LG Electronics	LG V60 Thin Q 5G(LMV600VM)	Android 12, 13

Weakness: CWE-927 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

References

https://lgsecurity.lge.com/bulletins/mobile#updateDetails vendor-advisory