{"id":"CVE-2023-5521","summary":"Incorrect Authorization in tiann/kernelsu","details":"Incorrect Authorization in GitHub repository tiann/kernelsu prior to v0.6.9.","modified":"2026-08-12T15:16:55.254736Z","published":"2023-10-11T12:00:01.900Z","database_specific":{"cwe_ids":["CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5521.json","cna_assigner":"@huntrdev"},"references":[{"type":"WEB","url":"https://huntr.dev/bounties/d438eff7-4e24-45e0-bc75-d3a5b3ab2ea1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5521.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5521"},{"type":"FIX","url":"https://github.com/tiann/kernelsu/commit/a22959beae1aad96b1f72710a5daadf529c41bda"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/tiann/kernelsu","events":[{"introduced":"0"},{"fixed":"88289399947e84ce59beb85e5c933d309e65f5ff"},{"fixed":"a22959beae1aad96b1f72710a5daadf529c41bda"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"0.6.9"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:kernelsu:kernelsu:*:*:*:*:*:*:*:*"}}],"versions":["v0.6.8","v0.6.7","v0.6.6","v0.6.2","v0.6.1","v0.6.0","v0.5.7","v0.5.6","v0.5.5","v0.5.4","v0.5.3","v0.5.2","v0.5.1","v0.5.0","v0.4.1","v0.4.0","v0.3.9","v0.3.8","v0.3.7","v0.3.6","v0.3.5","v0.3.4","v0.3.3","v0.3.2","v0.3.0","v0.1.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-5521.json","vanir_signatures_modified":"2026-08-12T15:16:55Z","vanir_signatures":[{"digest":{"line_hashes":["41580565958209333176061365568288670086","265114176601864080542208146343836328589","237646517167418479804070591896019906783","111754310832138625187302611223832310309","288500313966331194233952480306672923006","239726084033913983508812666055851085780","195547687429624663013063588491896554732","154654936356314812042646033200577626357","57216956010562796285750382165647891130","298187789312581134291094665466460950317","9058260360965248597304602175720463721","102341612407003564164157817000655242692","227002795457461559640802699980139731760","70693828122278356111467229855248478376","311006513307332531141793653646657414540","281848779119083889819010921718948693475","232564009839394486349118468320864315393","135526136307063669230195265706566198213","35244621108993698933883948833464264055","47591345427232626239243006989502924239","136310478144250955498532148985526494252","52249077895007103705776700506963499987","309645046217718127737119260418061554918","325195785543623332411810941256180953218","216020886236654962086158155451469088388","246776965967363503323011687109629378871","16050550529030295234326427914487666869","213715435905786510074078161900198087419","12814704180083527695856892052518122948","75348771054528671219953653747233998631","34567300531843442356847970566846296468","172947997338963845501026295059736397222","54273793468443685903793985201720679853","216115059525499767605222288046588077101","27496119169496746291735473682413604433","81912386545976147666911905119966257609","340282223528356276300098049895274668184","212210128146958217413568014588131109430","3720048185573658595417089044188980386","87666701298043807690639072341779645864","277915324706881219863161983757838235038","180511186704736975487070152927441132745","80728998663259025507355769515442596221","300425327096947965747233545123843485498","244587942851944326141089079402612498696","282308421755630541054899784068006342127","161152746291616934193825755295591122123","218582260884726957884229310093590330010","310386241443036897624641533446782749726","16052964437537848135815015742172576020","10145724908138355150143877326676932057","169553308242365929978285040080261752143","233251248504039276934611694207532566864","216603571484766882465546888868536167109","73240530498415859700803015151295492352","282308421755630541054899784068006342127","161152746291616934193825755295591122123","218582260884726957884229310093590330010","310386241443036897624641533446782749726","283291559709716890336628046576374206224","310968539809550060421398519520181530195","230104291737695851950098692012692498040","131907365065812948171369110913227350014","307470462360594863535161480477258969351","284469865008155457307349824913529477615","138036544895519975372661464658839596102","2574045503205332174018201972063558967","106882133512231289371976784955645914999","278445573845456962495118125552478367851","265718123883928557268088273947423553305","93578041097578908887782602475404026531","27524417613078785010087127662215595994","334380454869515471212302406391617943920","102183353333534231218882231432557802095","282249644897767135085615576089044498603","274755609107301788871431613149265596914","244411109232705076487557589189493618259","14787252186976803030639912016767754053","123234281808389629539048238866282897013","157028191256928987151388731549486910203","123507398500563381055056133050047300945","185948067363031202291584025688864418670","111824684119586560610355500786816241215","219704440071260733369135328407730839786","122416690541701417958667206373591683029","243447533808556519356358387810187487849","280753426298573931927761477297283071846","90867833619675160228857846364699070483","108082471961722693082586558513959758961","193375603777206520913752474396808251953","160543307934095365342497708134076468182","214279127878308678430693460232507676008","275218156352219138960836815059367462110","199632342078477875699550835709804912972","111025188042930222483238042732335430472","218434677594428082210724494816232198241","210963192341057091966644391137314814127"],"threshold":0.9},"id":"CVE-2023-5521-2464f57d","signature_type":"Line","signature_version":"v1","source":"https://github.com/tiann/kernelsu/commit/a22959beae1aad96b1f72710a5daadf529c41bda","target":{"file":"kernel/apk_sign.c"},"deprecated":false},{"id":"CVE-2023-5521-31f0d589","signature_type":"Function","signature_version":"v1","source":"https://github.com/tiann/kernelsu/commit/a22959beae1aad96b1f72710a5daadf529c41bda","target":{"file":"scripts/check_v2.c","function":"main"},"deprecated":false,"digest":{"function_hash":"142351012352027169171447869539372647432","length":100}},{"id":"CVE-2023-5521-34cfc11a","signature_type":"Line","signature_version":"v1","source":"https://github.com/tiann/kernelsu/commit/a22959beae1aad96b1f72710a5daadf529c41bda","target":{"file":"kernel/manager.c"},"deprecated":false,"digest":{"line_hashes":["202038385009100061501502625799183087926","229880334927361144930062335503787535603","84960674015754835778645605909762955952","100553576977105699471078365995018477427"],"threshold":0.9}},{"id":"CVE-2023-5521-35ecfb58","signature_type":"Function","signature_version":"v1","source":"https://github.com/tiann/kernelsu/commit/88289399947e84ce59beb85e5c933d309e65f5ff","target":{"file":"kernel/apk_sign.c","function":"check_v2_signature"},"deprecated":false,"digest":{"function_hash":"290464786034135243134045424827011163000","length":1751}},{"id":"CVE-2023-5521-5187d14a","signature_type":"Function","signature_version":"v1","source":"https://github.com/tiann/kernelsu/commit/a22959beae1aad96b1f72710a5daadf529c41bda","target":{"file":"scripts/check_v2.c","function":"isApkSigBlock42"},"deprecated":false,"digest":{"function_hash":"214435673092931465442932928531552320035","length":388}},{"deprecated":false,"digest":{"function_hash":"28512672846426628600080608153003800658","length":207},"id":"CVE-2023-5521-7572584d","signature_type":"Function","signature_version":"v1","source":"https://github.com/tiann/kernelsu/commit/a22959beae1aad96b1f72710a5daadf529c41bda","target":{"function":"set_expected_hash","file":"kernel/apk_sign.c"}},{"deprecated":false,"digest":{"function_hash":"319851236632388343828047139557110649628","length":2526},"id":"CVE-2023-5521-7e465f1b","signature_type":"Function","signature_version":"v1","source":"https://github.com/tiann/kernelsu/commit/a22959beae1aad96b1f72710a5daadf529c41bda","target":{"file":"scripts/check_v2.c","function":"checkSignature"}},{"signature_version":"v1","source":"https://github.com/tiann/kernelsu/commit/a22959beae1aad96b1f72710a5daadf529c41bda","target":{"file":"kernel/apk_sign.c","function":"check_v2_signature"},"deprecated":false,"digest":{"length":2275,"function_hash":"267768171224457165155538144529296321664"},"id":"CVE-2023-5521-8aa29e42","signature_type":"Function"},{"source":"https://github.com/tiann/kernelsu/commit/a22959beae1aad96b1f72710a5daadf529c41bda","target":{"file":"kernel/apk_sign.h"},"deprecated":false,"digest":{"line_hashes":["155362121217776979022663920835012756242"],"threshold":0.9},"id":"CVE-2023-5521-d9083fa3","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["49453303951151919183421106145426989225","229353761985416377069229035588866801280","136298574305077043361427929967379207460","201295667095462645014389675004837968592","24781579564782768434613692410224043840","322904521239700828280935014769000116270","205802361802978322806455942305138907599","74137351315691516257621196582759135926","154478214287090811252198049753301603782","12230374078232645693275934095224128685","123142303276090687320386991434593804516","145954138687569319650876039008584205390","329379990550521069549370640320298051396","101549282993167135475697856594524148261","88618885758516904615590021453594189524","183310077219301183618827941021724113462","9707943972938479715811334122926489479","259033728757261226497416793934618115173","289080267825967632791443056840278776123","9097238682146220237292267382351851289","248294674763762213391450755900240542254","149904645336665993828500510379581561674","118685567146143352382148360357489909522","326956356297276123546022701806421329410","296416102713761338325982604698011752593"],"threshold":0.9},"id":"CVE-2023-5521-e2868037","signature_type":"Line","signature_version":"v1","source":"https://github.com/tiann/kernelsu/commit/88289399947e84ce59beb85e5c933d309e65f5ff","target":{"file":"kernel/apk_sign.c"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/tiann/kernelsu/commit/a22959beae1aad96b1f72710a5daadf529c41bda","target":{"file":"scripts/check_v2.c"},"deprecated":false,"digest":{"line_hashes":["251927441347442404552021478017938661650","322077460189214225914716498610126851729","143069677945882823835077190682773260279","201360179929433454064560388865844611164","229782599327636948538782334248630783519","200096071760293339415645847251783390350","42842401511121974852322633340294293371","258549948489911392698695573051212371931","338002190526385346770269002803016362965","304393860774159546531188499060398511128","276586410013799777602839675338118468988","48841392673610260714225085702407018123","254325560027040929807645293389604984041","152012040047771056676870585191798924182","305149282479586500617629042257112423895","257079168625536921128396363392356742957","29979634867227024888574658777364830541","173746927438603390920426984436139709299","137262464746027475230270620222583548491","188547896200442609265684511426243298226","156109239302041783858295666854847878514","166421418391390859414665305303662933777","291954897223313713217819091109370314077","247476547005351826979643612718877087635","236748264081510553909242452715050654871","121912243103275915969524644749644093509","7428393165839956354324602634637696386","221422301006948342252531232821974707722","221051148892316483205154329219439115383","56710994624056299432503952630769279740","237946698743704656137816585869664844143","331743739563796018523231148205962396223","206853341151042993148029975297692891298","250274052729513101929175632438998631948","331051521725922405539416061981832911142","276731385963187579154006848517614393691","300912452754540771192693122008642897657","150377092846307528228673845366348574614","61106273732485197541682826827127204026","337525393203863735381325249902099411020","317508846367287937417025579748273659750","89528346387276244360926746835353034900","148632919202744150107827422345583066482","283492596287120928643578861563063699081","96726588850578879436272926225144908291","191102162811111886063442562161146520634","195562327474870516750855487149485104670","68850101175296268204548588217982145046","270575777294454230145523048529898153771","316860320843253652797281662899696701128","81757221395950956626746342994923629266","118436777731000458070501545266999476021","236079509242137068983194661945268050038","223112249034162151423370898561584849637","188661370453279738162006828746376044482","312109016340048318523863908158876841079","263063181446247778975762690440469176675","188539278794643487528807713390906055359","76743033625067447437222314938364231006","338999341905777127005955699371232350095","121070534943779218260142571501918582355","238543090260943381867453924690369437944","62654467920511888874225649110570337180","53353477635480806751986435180317688989","240866148955018195242451268198647540825","134305705771598540956590903383318391656","111174710871323192580461383167030979767","223392726417237240664552254324473500535","150708400099386305553640869497752329229","334501082219890135422421341988200438876","323275916092357893604285454525741826987","300619853963106385761989888155034706398","277093571908445700855249419063107282594","86612798431502358305842364714314257621","169356558025509832171144791575850854098","176864017199487552747423460376649605700","115706902402570514496054632264694980174","204130229714745332021795585122764653788","200310906782554870140958777002908723057","243466011168583280092171977350204749988","249107630315752041466859857888409250499","230884862235550721402092559447456827498","39852993874521658050096501451728542494","225189136050461559339283559446190292150","86150680284973578546118282930967769926","19791060040695211935982998147357202914","313005527424743324874305012052790606806","48339213477576715084349370931821085886","198789605956089984056082689397048249563","240266821830939057859309184521357261009","56984719408888613719561801151493333992","144459250015928411244873627228522148437","256310200577759488068718923887686768869","242656616603605512894462397256523494989","155019711807058919831542803624757698916","169099685699879001419370965809931519097","184649699380367269498513805763293942834","258587593088348936556764429933571720474","310501947353138219241566620441183867829","232337618290980960252353487970038737584","130639348257381234764024146809821022225","16726551339837928374932286908838016720","60869990170335362691706226289024479329","55224803304050185114143322702739782076","41783729136049890857428991975262797398","298010316351900120089450314041355407728","49599049703413372096683764263583663538","137009164421831062141348374525132171903","78253745162109349477071136249835952997","268757076521247411825795671213770768022","190829412971915204597890323492899758162","244253314220856056879265142354099247562","138944223561351076770098695253123743306","30880716186501637459629128452885842690","55224803304050185114143322702739782076","41783729136049890857428991975262797398","298010316351900120089450314041355407728","49599049703413372096683764263583663538","99048494548583596927379848640535643727","163267548839359690030247606631941358680","84169849958041962016198475182590491788","162043722811576575040232358708098983143","284469865008155457307349824913529477615","251708787152002751274355528628130532425","307003956476321315599338322549024316981","207031413604079258526425055929806300898","244287164860215152432659018510023930424","203953371629998565028847358624698713402","34389040023643154619130844614269947671","6102863310932760288417883832133285943","160048442550476687296905157640566039774","263325862978447430715282288358924718939","265156234837460427659652934944782928925","104663067198783894890109106505834244940","278139447123475614161753189812189641402","305432817157514370073136620821618004502","46347133519364839893894309753697859459","233073624390584017818237139345384965711","92746235479313147928159613168853390505","216176694820191179884596555557617534768","30635478549209571129522085048792323461","74717188786997572443815712583604264706"],"threshold":0.9},"id":"CVE-2023-5521-f33a03c0"},{"deprecated":false,"digest":{"function_hash":"55679417958099768682472713715131093854","length":1241},"id":"CVE-2023-5521-faddf1e3","signature_type":"Function","signature_version":"v1","source":"https://github.com/tiann/kernelsu/commit/a22959beae1aad96b1f72710a5daadf529c41bda","target":{"file":"kernel/manager.c","function":"become_manager"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}]}