CVE-2023-21374

Vulnerability

A logic error in Android System UI allows a local attacker to bypass factory reset protection. The vulnerability exists in Android 14 prior to the 2023-10-01 security patch level. No user interaction is required for exploitation [1].

Exploitation

An attacker with local access and no additional execution privileges can trigger the logic error to bypass factory reset protection. User interaction is not needed; the attacker can exploit the vulnerability by executing a crafted application or using existing privileges on the device [1].

Impact

Successful exploitation leads to local escalation of privilege, enabling the attacker to bypass factory reset protection. This could allow the attacker to reset the device or gain elevated access to system functions, compromising device integrity and confidentiality [1].

Mitigation

The issue is fixed in Android 14 with the 2023-10-01 security patch level. Users should update their devices to this patch level or later. There are no reported workarounds. No active exploitation has been reported [1].