{"id":"ASB-A-257954050","details":"In canDisplayLocalUi of AppLocalePickerActivity.java, there is a possible way to change system app locales due to a missing permission check. This could lead to local denial of service across user boundaries with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-257954050","CVE-2023-21091"],"modified":"2026-04-17T15:55:28.020024Z","published":"2023-04-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-04-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Settings/+/211f81afe632cc7b5e085adfb3d7949d80e0b810"}],"affected":[{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13-next:0"},{"fixed":"13-next:2023-04-01"}]}],"versions":["13-next"],"ecosystem_specific":{"spl":"2023-04-01","severity":"High","types":["DoS"],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/ed9cbdea18c532a1264bfe7e4043496059e1e5fd"],"vanir_signatures":[{"id":"ASB-A-257954050-0ef27ced","digest":{"threshold":0.9,"line_hashes":["166050417202853291701751339784057791791","199979913566983760122768267456903554462","189924521193495092609515074354735996291","116243438245727173131782871328633947081","4804168085541400234835857522753479322","110681149833535123982358261489811169555","17892716231854941928447848842989604752","192315469113083916891583938974578089706","38316968045572558241649475757631654873","84766275637447259059812531520649854439","222539472553025219923603023730158880274","93729298876976084149185093781009605841","60311274904798221900252526941281947497","48184161827913377360016065589221965881","19702977024012449088900035296716362127","150448211190717172863285810657828192554","134484519965543013623848411296268696820","308239576561945886121920637427829306355","262894840504648576812598287353762829208"]},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/ed9cbdea18c532a1264bfe7e4043496059e1e5fd","target":{"file":"src/com/android/settings/localepicker/AppLocalePickerActivity.java"},"signature_type":"Line","deprecated":false,"signature_version":"v1"},{"id":"ASB-A-257954050-a5c19189","digest":{"length":1001,"function_hash":"328124894360867882052371090196316249512"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/ed9cbdea18c532a1264bfe7e4043496059e1e5fd","target":{"file":"src/com/android/settings/localepicker/AppLocalePickerActivity.java","function":"onCreate"},"signature_type":"Function","deprecated":false,"signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-257954050.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-04-01"}]}],"versions":["13"],"ecosystem_specific":{"spl":"2023-04-01","severity":"High","types":["DoS"],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/33ef83795e44f9360d9113df0f309e99f47be23e"],"vanir_signatures":[{"id":"ASB-A-257954050-6ef081c6","digest":{"threshold":0.9,"line_hashes":["166050417202853291701751339784057791791","199979913566983760122768267456903554462","189924521193495092609515074354735996291","116243438245727173131782871328633947081","4804168085541400234835857522753479322","110681149833535123982358261489811169555","17892716231854941928447848842989604752","192315469113083916891583938974578089706","38316968045572558241649475757631654873","84766275637447259059812531520649854439","222539472553025219923603023730158880274","93729298876976084149185093781009605841","60311274904798221900252526941281947497","48184161827913377360016065589221965881","19702977024012449088900035296716362127","150448211190717172863285810657828192554","134484519965543013623848411296268696820","308239576561945886121920637427829306355","262894840504648576812598287353762829208"]},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/33ef83795e44f9360d9113df0f309e99f47be23e","target":{"file":"src/com/android/settings/localepicker/AppLocalePickerActivity.java"},"signature_type":"Line","deprecated":false,"signature_version":"v1"},{"id":"ASB-A-257954050-737c2e84","digest":{"length":1001,"function_hash":"328124894360867882052371090196316249512"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/33ef83795e44f9360d9113df0f309e99f47be23e","target":{"file":"src/com/android/settings/localepicker/AppLocalePickerActivity.java","function":"onCreate"},"signature_type":"Function","deprecated":false,"signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-257954050.json"}}],"schema_version":"1.7.5"}