{"id":"ASB-A-279902472","details":"In onCreate of ApnEditor.java, there is a possible way for a Guest user to change the APN due to a permission bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-279902472","CVE-2023-40125"],"modified":"2026-05-25T16:46:24.913870386Z","published":"2023-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-10-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Settings/+/63d464c3fa5c7b9900448fef3844790756e557eb"}],"affected":[{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14-next:0"},{"fixed":"14-next:2023-10-01"}]}],"versions":["14-next"],"ecosystem_specific":{"severity":"High","fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/4e18e7414c674a1c5bc69961c03499849b4aefd2"],"types":["EoP"],"spl":"2023-10-01","vanir_signatures":[{"id":"ASB-A-279902472-4f95ed50","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4e18e7414c674a1c5bc69961c03499849b4aefd2","signature_type":"Function","signature_version":"v1","digest":{"length":2063,"function_hash":"152610087046714648780611739448265895775"},"deprecated":false,"target":{"function":"onCreate","file":"src/com/android/settings/network/apn/ApnEditor.java"}},{"digest":{"threshold":0.9,"line_hashes":["100041008446260560396476630504279122632","197440316143246402731199565354473608321","70840163502051476079726514185892266905","244617952890001118372071042936428388011","253967541776609911089824468622285267085","162574523912741452380634460621824356014","45614435444533552429023121767383526343","271285628984379760273372622606079034026","220136755168173347836623543778097906037","127548030616501896579967466812780655682","226212641881934404685962328827268654771","6291049940031259618325275032442921755"]},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4e18e7414c674a1c5bc69961c03499849b4aefd2","signature_type":"Line","signature_version":"v1","id":"ASB-A-279902472-f1f8637b","target":{"file":"src/com/android/settings/network/apn/ApnEditor.java"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-279902472.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2023-10-01"}]}],"versions":["11"],"ecosystem_specific":{"severity":"High","spl":"2023-10-01","fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/5c2d727b8f9198bf758a4896eda7c9e5385435ff"],"types":["EoP"],"vanir_signatures":[{"digest":{"length":1839,"function_hash":"34987420686896681253052769836241055652"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/5c2d727b8f9198bf758a4896eda7c9e5385435ff","target":{"function":"onCreate","file":"src/com/android/settings/network/ApnEditor.java"},"signature_version":"v1","signature_type":"Function","id":"ASB-A-279902472-55827adc","deprecated":false},{"id":"ASB-A-279902472-b84b6f97","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/5c2d727b8f9198bf758a4896eda7c9e5385435ff","signature_type":"Line","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["100041008446260560396476630504279122632","197440316143246402731199565354473608321","70840163502051476079726514185892266905","244617952890001118372071042936428388011","38196262269454676375805172647623459301","162574523912741452380634460621824356014","45614435444533552429023121767383526343","271285628984379760273372622606079034026","257647301880991909851187323489183030391","302527794259696103092579999911948872205","249004662640481674558636069371120830480"]},"deprecated":false,"target":{"file":"src/com/android/settings/network/ApnEditor.java"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-279902472.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2023-10-01"}]}],"versions":["12"],"ecosystem_specific":{"severity":"High","fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/e3b554b29674ef20946451d0b46d3213838e753d"],"types":["EoP"],"spl":"2023-10-01","vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["100041008446260560396476630504279122632","197440316143246402731199565354473608321","70840163502051476079726514185892266905","244617952890001118372071042936428388011","38196262269454676375805172647623459301","162574523912741452380634460621824356014","45614435444533552429023121767383526343","271285628984379760273372622606079034026","220136755168173347836623543778097906037","127548030616501896579967466812780655682","226212641881934404685962328827268654771","6291049940031259618325275032442921755"]},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/e3b554b29674ef20946451d0b46d3213838e753d","target":{"file":"src/com/android/settings/network/apn/ApnEditor.java"},"signature_version":"v1","signature_type":"Line","id":"ASB-A-279902472-658735d8","deprecated":false},{"digest":{"length":1839,"function_hash":"34987420686896681253052769836241055652"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/e3b554b29674ef20946451d0b46d3213838e753d","signature_type":"Function","signature_version":"v1","deprecated":false,"target":{"function":"onCreate","file":"src/com/android/settings/network/apn/ApnEditor.java"},"id":"ASB-A-279902472-91ffd49a"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-279902472.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2023-10-01"}]}],"versions":["12L"],"ecosystem_specific":{"severity":"High","types":["EoP"],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/6afcad76262ff87e0dd7c6d0394e00fcff0c1c6b"],"spl":"2023-10-01","vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["100041008446260560396476630504279122632","197440316143246402731199565354473608321","70840163502051476079726514185892266905","244617952890001118372071042936428388011","38196262269454676375805172647623459301","162574523912741452380634460621824356014","45614435444533552429023121767383526343","271285628984379760273372622606079034026","220136755168173347836623543778097906037","127548030616501896579967466812780655682","226212641881934404685962328827268654771","6291049940031259618325275032442921755"]},"deprecated":false,"target":{"file":"src/com/android/settings/network/apn/ApnEditor.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/6afcad76262ff87e0dd7c6d0394e00fcff0c1c6b","signature_type":"Line","id":"ASB-A-279902472-a8b1b21d"},{"digest":{"length":1839,"function_hash":"34987420686896681253052769836241055652"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/6afcad76262ff87e0dd7c6d0394e00fcff0c1c6b","signature_type":"Function","signature_version":"v1","id":"ASB-A-279902472-b994e9f2","target":{"function":"onCreate","file":"src/com/android/settings/network/apn/ApnEditor.java"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-279902472.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-10-01"}]}],"versions":["13"],"ecosystem_specific":{"severity":"High","vanir_signatures":[{"id":"ASB-A-279902472-0de5b231","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/ef2fd5b7cd74426568e8e82fb0dcddbfdaa943bf","signature_type":"Function","signature_version":"v1","digest":{"length":2050,"function_hash":"120011954125153054742972270375951367173"},"deprecated":false,"target":{"function":"onCreate","file":"src/com/android/settings/network/apn/ApnEditor.java"}},{"digest":{"threshold":0.9,"line_hashes":["100041008446260560396476630504279122632","197440316143246402731199565354473608321","70840163502051476079726514185892266905","244617952890001118372071042936428388011","253967541776609911089824468622285267085","162574523912741452380634460621824356014","45614435444533552429023121767383526343","271285628984379760273372622606079034026","220136755168173347836623543778097906037","127548030616501896579967466812780655682","226212641881934404685962328827268654771","6291049940031259618325275032442921755"]},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/ef2fd5b7cd74426568e8e82fb0dcddbfdaa943bf","signature_type":"Line","signature_version":"v1","deprecated":false,"target":{"file":"src/com/android/settings/network/apn/ApnEditor.java"},"id":"ASB-A-279902472-2e292ee8"}],"types":["EoP"],"spl":"2023-10-01","fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/ef2fd5b7cd74426568e8e82fb0dcddbfdaa943bf"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-279902472.json"}}],"schema_version":"1.7.5"}