Vulnerability · Published Jan 2, 2024 · Assigned by GitHub_M

CVE-2023-49794The logic of get apk path in KernelSU module can be bypassed

Medium 6.7

In plain English

A medium-severity authentication bypass by spoofing in KernelSU from tiann. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)6.7Medium

Exploit odds (30 days)0.3%top 83.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

KernelSU is a Kernel-based root solution for Android devices. In versions 0.7.1 and prior, the logic of get apk path in KernelSU kernel module can be bypassed, which causes any malicious apk named `me.weishu.kernelsu` get root permission. If a KernelSU module installed device try to install any not checked apk which package name equal to the official KernelSU Manager, it can take over root privileges on the device. As of time of publication, a patched version is not available.

Affected products (as reported)

Vendor	Product	Versions
tiann	KernelSU	<= 0.7.1

Weakness: CWE-290 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/tiann/KernelSU/security/advisories/GHSA-8rc5-x54x-5qc4 x_refsource_CONFIRM
https://drive.google.com/file/d/1b9UrmG_co9EJXB_yMBneRArUIR5sTuaN/view?usp=drive_link x_refsource_MISC