CVE-2023-46139

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-46139", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-10-16T17:51:35.574Z", "datePublished": "2023-10-30T23:58:05.891Z", "dateUpdated": "2024-09-05T20:16:47.667Z"}, "containers": {"cna": {"title": "KernelSU signature validation mismatch", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/tiann/KernelSU/security/advisories/GHSA-86cp-3prf-pwqq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/tiann/KernelSU/security/advisories/GHSA-86cp-3prf-pwqq"}, {"name": "https://github.com/tiann/KernelSU/commit/d24813b2c3738f2f9bd762932141cadd948c354f", "tags": ["x_refsource_MISC"], "url": "https://github.com/tiann/KernelSU/commit/d24813b2c3738f2f9bd762932141cadd948c354f"}, {"name": "https://drive.google.com/drive/folders/1XdYCCAhC_mkt1k1IyUiwcgFsuOFvwNRl", "tags": ["x_refsource_MISC"], "url": "https://drive.google.com/drive/folders/1XdYCCAhC_mkt1k1IyUiwcgFsuOFvwNRl"}, {"name": "https://github.com/tiann/KernelSU/blob/344c08bb79ba12b692016750cda363f9f3500182/kernel/apk_sign.c#L179C32-L179C32", "tags": ["x_refsource_MISC"], "url": "https://github.com/tiann/KernelSU/blob/344c08bb79ba12b692016750cda363f9f3500182/kernel/apk_sign.c#L179C32-L179C32"}, {"name": "https://github.com/tiann/KernelSU/blob/344c08bb79ba12b692016750cda363f9f3500182/kernel/apk_sign.c#L188", "tags": ["x_refsource_MISC"], "url": "https://github.com/tiann/KernelSU/blob/344c08bb79ba12b692016750cda363f9f3500182/kernel/apk_sign.c#L188"}, {"name": "http://aospxref.com/android-14.0.0_r2/xref/frameworks/base/core/java/android/util/apk/ApkSigningBlockUtils.java#770", "tags": ["x_refsource_MISC"], "url": "http://aospxref.com/android-14.0.0_r2/xref/frameworks/base/core/java/android/util/apk/ApkSigningBlockUtils.java#770"}, {"name": "http://aospxref.com/android-14.0.0_r2/xref/frameworks/base/core/java/android/util/apk/ApkSigningBlockUtils.java#783", "tags": ["x_refsource_MISC"], "url": "http://aospxref.com/android-14.0.0_r2/xref/frameworks/base/core/java/android/util/apk/ApkSigningBlockUtils.java#783"}], "affected": [{"vendor": "tiann", "product": "KernelSU", "versions": [{"version": ">= 0.6.1, < 0.7.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-10-30T23:58:05.891Z"}, "descriptions": [{"lang": "en", "value": "KernelSU is a Kernel based root solution for Android. Starting in version 0.6.1 and prior to version 0.7.0, if a KernelSU installed device is infected with a malware whose app signing block specially constructed, it can take over root privileges on the device. The vulnerable verification logic actually obtains the signature of the last block with an id of `0x7109871a`, while the verification logic during Android installation is to obtain the first one. In addition to the actual signature upgrade that has been fixed (KSU thought it was V2 but was actually V3), there is also the problem of actual signature downgrading (KSU thought it was V2 but was actually V1). Find a condition in the signature verification logic that will cause the signature not to be found error, and KernelSU does not implement the same conditions, so KSU thinks there is a V2 signature, but the APK signature verification actually uses the V1 signature. This issue is fixed in version 0.7.0. As workarounds, keep the KernelSU manager installed and avoid installing unknown apps."}], "source": {"advisory": "GHSA-86cp-3prf-pwqq", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:37:39.905Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/tiann/KernelSU/security/advisories/GHSA-86cp-3prf-pwqq", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/tiann/KernelSU/security/advisories/GHSA-86cp-3prf-pwqq"}, {"name": "https://github.com/tiann/KernelSU/commit/d24813b2c3738f2f9bd762932141cadd948c354f", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/tiann/KernelSU/commit/d24813b2c3738f2f9bd762932141cadd948c354f"}, {"name": "https://drive.google.com/drive/folders/1XdYCCAhC_mkt1k1IyUiwcgFsuOFvwNRl", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://drive.google.com/drive/folders/1XdYCCAhC_mkt1k1IyUiwcgFsuOFvwNRl"}, {"name": "https://github.com/tiann/KernelSU/blob/344c08bb79ba12b692016750cda363f9f3500182/kernel/apk_sign.c#L179C32-L179C32", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/tiann/KernelSU/blob/344c08bb79ba12b692016750cda363f9f3500182/kernel/apk_sign.c#L179C32-L179C32"}, {"name": "https://github.com/tiann/KernelSU/blob/344c08bb79ba12b692016750cda363f9f3500182/kernel/apk_sign.c#L188", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/tiann/KernelSU/blob/344c08bb79ba12b692016750cda363f9f3500182/kernel/apk_sign.c#L188"}, {"name": "http://aospxref.com/android-14.0.0_r2/xref/frameworks/base/core/java/android/util/apk/ApkSigningBlockUtils.java#770", "tags": ["x_refsource_MISC", "x_transferred"], "url": "http://aospxref.com/android-14.0.0_r2/xref/frameworks/base/core/java/android/util/apk/ApkSigningBlockUtils.java#770"}, {"name": "http://aospxref.com/android-14.0.0_r2/xref/frameworks/base/core/java/android/util/apk/ApkSigningBlockUtils.java#783", "tags": ["x_refsource_MISC", "x_transferred"], "url": "http://aospxref.com/android-14.0.0_r2/xref/frameworks/base/core/java/android/util/apk/ApkSigningBlockUtils.java#783"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-05T20:16:38.606468Z", "id": "CVE-2023-46139", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-05T20:16:47.667Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/tiann/KernelSU/security/advisories/GHSA-86cp-3prf-pwqq", "name": "https://github.com/tiann/KernelSU/security/advisories/GHSA-86cp-3prf-pwqq", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/tiann/KernelSU/commit/d24813b2c3738f2f9bd762932141cadd948c354f", "name": "https://github.com/tiann/KernelSU/commit/d24813b2c3738f2f9bd762932141cadd948c354f", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://drive.google.com/drive/folders/1XdYCCAhC_mkt1k1IyUiwcgFsuOFvwNRl", "name": "https://drive.google.com/drive/folders/1XdYCCAhC_mkt1k1IyUiwcgFsuOFvwNRl", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/tiann/KernelSU/blob/344c08bb79ba12b692016750cda363f9f3500182/kernel/apk_sign.c#L179C32-L179C32", "name": "https://github.com/tiann/KernelSU/blob/344c08bb79ba12b692016750cda363f9f3500182/kernel/apk_sign.c#L179C32-L179C32", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/tiann/KernelSU/blob/344c08bb79ba12b692016750cda363f9f3500182/kernel/apk_sign.c#L188", "name": "https://github.com/tiann/KernelSU/blob/344c08bb79ba12b692016750cda363f9f3500182/kernel/apk_sign.c#L188", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "http://aospxref.com/android-14.0.0_r2/xref/frameworks/base/core/java/android/util/apk/ApkSigningBlockUtils.java#770", "name": "http://aospxref.com/android-14.0.0_r2/xref/frameworks/base/core/java/android/util/apk/ApkSigningBlockUtils.java#770", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "http://aospxref.com/android-14.0.0_r2/xref/frameworks/base/core/java/android/util/apk/ApkSigningBlockUtils.java#783", "name": "http://aospxref.com/android-14.0.0_r2/xref/frameworks/base/core/java/android/util/apk/ApkSigningBlockUtils.java#783", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:37:39.905Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-46139", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-05T20:16:38.606468Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-05T20:16:43.973Z"}}], "cna": {"title": "KernelSU signature validation mismatch", "source": {"advisory": "GHSA-86cp-3prf-pwqq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "tiann", "product": "KernelSU", "versions": [{"status": "affected", "version": ">= 0.6.1, < 0.7.0"}]}], "references": [{"url": "https://github.com/tiann/KernelSU/security/advisories/GHSA-86cp-3prf-pwqq", "name": "https://github.com/tiann/KernelSU/security/advisories/GHSA-86cp-3prf-pwqq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/tiann/KernelSU/commit/d24813b2c3738f2f9bd762932141cadd948c354f", "name": "https://github.com/tiann/KernelSU/commit/d24813b2c3738f2f9bd762932141cadd948c354f", "tags": ["x_refsource_MISC"]}, {"url": "https://drive.google.com/drive/folders/1XdYCCAhC_mkt1k1IyUiwcgFsuOFvwNRl", "name": "https://drive.google.com/drive/folders/1XdYCCAhC_mkt1k1IyUiwcgFsuOFvwNRl", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/tiann/KernelSU/blob/344c08bb79ba12b692016750cda363f9f3500182/kernel/apk_sign.c#L179C32-L179C32", "name": "https://github.com/tiann/KernelSU/blob/344c08bb79ba12b692016750cda363f9f3500182/kernel/apk_sign.c#L179C32-L179C32", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/tiann/KernelSU/blob/344c08bb79ba12b692016750cda363f9f3500182/kernel/apk_sign.c#L188", "name": "https://github.com/tiann/KernelSU/blob/344c08bb79ba12b692016750cda363f9f3500182/kernel/apk_sign.c#L188", "tags": ["x_refsource_MISC"]}, {"url": "http://aospxref.com/android-14.0.0_r2/xref/frameworks/base/core/java/android/util/apk/ApkSigningBlockUtils.java#770", "name": "http://aospxref.com/android-14.0.0_r2/xref/frameworks/base/core/java/android/util/apk/ApkSigningBlockUtils.java#770", "tags": ["x_refsource_MISC"]}, {"url": "http://aospxref.com/android-14.0.0_r2/xref/frameworks/base/core/java/android/util/apk/ApkSigningBlockUtils.java#783", "name": "http://aospxref.com/android-14.0.0_r2/xref/frameworks/base/core/java/android/util/apk/ApkSigningBlockUtils.java#783", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "KernelSU is a Kernel based root solution for Android. Starting in version 0.6.1 and prior to version 0.7.0, if a KernelSU installed device is infected with a malware whose app signing block specially constructed, it can take over root privileges on the device. The vulnerable verification logic actually obtains the signature of the last block with an id of `0x7109871a`, while the verification logic during Android installation is to obtain the first one. In addition to the actual signature upgrade that has been fixed (KSU thought it was V2 but was actually V3), there is also the problem of actual signature downgrading (KSU thought it was V2 but was actually V1). Find a condition in the signature verification logic that will cause the signature not to be found error, and KernelSU does not implement the same conditions, so KSU thinks there is a V2 signature, but the APK signature verification actually uses the V1 signature. This issue is fixed in version 0.7.0. As workarounds, keep the KernelSU manager installed and avoid installing unknown apps."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-10-30T23:58:05.891Z"}}}, "cveMetadata": {"cveId": "CVE-2023-46139", "state": "PUBLISHED", "dateUpdated": "2024-09-05T20:16:47.667Z", "dateReserved": "2023-10-16T17:51:35.574Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-10-30T23:58:05.891Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "KernelSU", "vendor": "tiann", "versions": [{"status": "affected", "version": ">= 0.6.1, < 0.7.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:kernelsu:kernelsu:*:*:*:*:*:*:*:*", "matchCriteriaId": "095D0E7A-9E6D-4FE1-8C73-273856682B11", "versionEndExcluding": "0.7.0", "versionStartIncluding": "0.6.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "KernelSU is a Kernel based root solution for Android. Starting in version 0.6.1 and prior to version 0.7.0, if a KernelSU installed device is infected with a malware whose app signing block specially constructed, it can take over root privileges on the device. The vulnerable verification logic actually obtains the signature of the last block with an id of `0x7109871a`, while the verification logic during Android installation is to obtain the first one. In addition to the actual signature upgrade that has been fixed (KSU thought it was V2 but was actually V3), there is also the problem of actual signature downgrading (KSU thought it was V2 but was actually V1). Find a condition in the signature verification logic that will cause the signature not to be found error, and KernelSU does not implement the same conditions, so KSU thinks there is a V2 signature, but the APK signature verification actually uses the V1 signature. This issue is fixed in version 0.7.0. As workarounds, keep the KernelSU manager installed and avoid installing unknown apps."}, {"lang": "es", "value": "KernelSU es una soluci\u00f3n ra\u00edz basada en Kernel para Android. A partir de la versi\u00f3n 0.6.1 y anteriores a la versi\u00f3n 0.7.0, si un dispositivo instalado con KernelSU est\u00e1 infectado con un malware cuyo bloque de firma de aplicaci\u00f3n est\u00e1 especialmente construido, puede asumir los privilegios de root en el dispositivo. La l\u00f3gica de verificaci\u00f3n vulnerable en realidad obtiene la firma del \u00faltimo bloque con una identificaci\u00f3n de `0x7109871a`, mientras que la l\u00f3gica de verificaci\u00f3n durante la instalaci\u00f3n de Android es obtener la primera. Adem\u00e1s de la actualizaci\u00f3n de la firma real que se ha solucionado (KSU pens\u00f3 que era V2 pero en realidad era V3), tambi\u00e9n existe el problema de la degradaci\u00f3n de la firma real (KSU pens\u00f3 que era V2 pero en realidad era V1). Encuentre una condici\u00f3n en la l\u00f3gica de verificaci\u00f3n de firma que causar\u00e1 un error de no encontrar la firma, y KernelSU no implementa las mismas condiciones, por lo que KSU cree que hay una firma V2, pero la verificaci\u00f3n de firma APK en realidad usa la firma V1. Este problema se solucion\u00f3 en la versi\u00f3n 0.7.0. Como workarounds, mantenga instalado el administrador KernelSU y evite instalar aplicaciones desconocidas."}], "id": "CVE-2023-46139", "lastModified": "2026-06-17T06:30:14.107", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 3.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.5, "impactScore": 3.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-46139", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-05T20:16:38.606468Z", "version": "2.0.3"}}]}, "published": "2023-10-31T00:15:10.107", "references": [{"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "http://aospxref.com/android-14.0.0_r2/xref/frameworks/base/core/java/android/util/apk/ApkSigningBlockUtils.java#770"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "http://aospxref.com/android-14.0.0_r2/xref/frameworks/base/core/java/android/util/apk/ApkSigningBlockUtils.java#783"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://drive.google.com/drive/folders/1XdYCCAhC_mkt1k1IyUiwcgFsuOFvwNRl"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/tiann/KernelSU/blob/344c08bb79ba12b692016750cda363f9f3500182/kernel/apk_sign.c#L179C32-L179C32"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/tiann/KernelSU/blob/344c08bb79ba12b692016750cda363f9f3500182/kernel/apk_sign.c#L188"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/tiann/KernelSU/commit/d24813b2c3738f2f9bd762932141cadd948c354f"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/tiann/KernelSU/security/advisories/GHSA-86cp-3prf-pwqq"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://aospxref.com/android-14.0.0_r2/xref/frameworks/base/core/java/android/util/apk/ApkSigningBlockUtils.java#770"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://aospxref.com/android-14.0.0_r2/xref/frameworks/base/core/java/android/util/apk/ApkSigningBlockUtils.java#783"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://drive.google.com/drive/folders/1XdYCCAhC_mkt1k1IyUiwcgFsuOFvwNRl"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/tiann/KernelSU/blob/344c08bb79ba12b692016750cda363f9f3500182/kernel/apk_sign.c#L179C32-L179C32"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/tiann/KernelSU/blob/344c08bb79ba12b692016750cda363f9f3500182/kernel/apk_sign.c#L188"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/tiann/KernelSU/commit/d24813b2c3738f2f9bd762932141cadd948c354f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/tiann/KernelSU/security/advisories/GHSA-86cp-3prf-pwqq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}