{"id":"PUB-A-213942596","details":"In startLockTaskMode of LockTaskController.java, there is a possible bypass of lock task mode due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-213942596","CVE-2023-21189"],"modified":"2026-09-22T15:22:15.314525410Z","published":"2023-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-06-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13-next:0"},{"fixed":"13-next:2023-06-01"}]}],"versions":["13-next"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/540a7c32d856f9513ea26ffc4c2b9327f5a3a1b5","target":{"file":"services/core/java/com/android/server/wm/LockTaskController.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["259590963378098019506138773829549726153","339731208879213533049567795100393404370","196842569068323951505900298715565166870","329733562905097744143027745382026588143","205720209166383107665338544471551891192","252592248164189551111874193086298457144","11183545669860951576976821910399386373","146128305057215544987682115085342880259","313500056888642801637444288999960462611","193185042778935079970618334693391798638","94083546051730497024410521945825167427","153427308011463891186300293872838534710","36838674328849096973044875888633244617","190408238883794878463308171751115756505","271613605246077307531870517792878558420","30164921329345463907376268405083112938","312357646526305047107130809857572748499","278809718551186143364820167822115175274","210970647024931410295177236523325314805","318301413169897740538445308134677301705"]},"id":"PUB-A-213942596-12ae4e14","match_only_versions":["13-next"],"signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"191887681608595310044475575209842618885","length":580},"id":"PUB-A-213942596-4d2c3de6","match_only_versions":["13-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/540a7c32d856f9513ea26ffc4c2b9327f5a3a1b5","target":{"file":"services/core/java/com/android/server/wm/LockTaskController.java","function":"startLockTaskMode"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/540a7c32d856f9513ea26ffc4c2b9327f5a3a1b5","target":{"file":"services/core/java/com/android/server/wm/LockTaskController.java","function":"stopLockTaskMode"},"deprecated":false,"digest":{"function_hash":"55480523965645955638706682677571455470","length":717},"id":"PUB-A-213942596-cda4de2f","match_only_versions":["13-next"],"signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/540a7c32d856f9513ea26ffc4c2b9327f5a3a1b5"],"severity":"Moderate","spl":"2023-06-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-213942596.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-06-01"}]}],"versions":["13"],"ecosystem_specific":{"vanir_signatures":[{"match_only_versions":["13"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/540a7c32d856f9513ea26ffc4c2b9327f5a3a1b5","target":{"file":"services/core/java/com/android/server/wm/LockTaskController.java"},"deprecated":false,"digest":{"line_hashes":["259590963378098019506138773829549726153","339731208879213533049567795100393404370","196842569068323951505900298715565166870","329733562905097744143027745382026588143","205720209166383107665338544471551891192","252592248164189551111874193086298457144","11183545669860951576976821910399386373","146128305057215544987682115085342880259","313500056888642801637444288999960462611","193185042778935079970618334693391798638","94083546051730497024410521945825167427","153427308011463891186300293872838534710","36838674328849096973044875888633244617","190408238883794878463308171751115756505","271613605246077307531870517792878558420","30164921329345463907376268405083112938","312357646526305047107130809857572748499","278809718551186143364820167822115175274","210970647024931410295177236523325314805","318301413169897740538445308134677301705"],"threshold":0.9},"id":"PUB-A-213942596-22c0fc64"},{"id":"PUB-A-213942596-a4a3fbbc","match_only_versions":["13"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/540a7c32d856f9513ea26ffc4c2b9327f5a3a1b5","target":{"file":"services/core/java/com/android/server/wm/LockTaskController.java","function":"stopLockTaskMode"},"deprecated":false,"digest":{"function_hash":"55480523965645955638706682677571455470","length":717}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/540a7c32d856f9513ea26ffc4c2b9327f5a3a1b5","target":{"function":"startLockTaskMode","file":"services/core/java/com/android/server/wm/LockTaskController.java"},"deprecated":false,"digest":{"length":580,"function_hash":"191887681608595310044475575209842618885"},"id":"PUB-A-213942596-e0328ab3","match_only_versions":["13"],"signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/540a7c32d856f9513ea26ffc4c2b9327f5a3a1b5"],"severity":"Moderate","spl":"2023-06-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-213942596.json"}}],"schema_version":"1.9.0"}