{"id":"PUB-A-227207653","details":"In setInputMethodWithSubtypeIdLocked of InputMethodManagerService.java, there is a possible way to setup input methods that are not enabled due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-227207653","CVE-2023-21192"],"modified":"2026-05-28T15:16:54.500952700Z","published":"2023-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-06-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13-next:0"},{"fixed":"13-next:2023-06-01"}]}],"versions":["13-next"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/55f6a873458b72b99364d531e9e0cd54236f1cc1","https://android.googlesource.com/platform/frameworks/base/+/55f6a873458b72b99364d531e9e0cd54236f1cc1"],"severity":"Moderate","spl":"2023-06-01","vanir_signatures":[{"signature_type":"Line","digest":{"line_hashes":["62254932137817019122658985252098018523","295964014840922994294226066991664009830","202812284309818429619527170475318128107","176704292464204913468701428427164499249"],"threshold":0.9},"signature_version":"v1","deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/55f6a873458b72b99364d531e9e0cd54236f1cc1","target":{"file":"services/core/java/com/android/server/inputmethod/InputMethodManagerService.java"},"id":"PUB-A-227207653-15ca8a0b"},{"digest":{"length":613,"function_hash":"307625859859531589155261964946132188509"},"signature_type":"Function","signature_version":"v1","deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/55f6a873458b72b99364d531e9e0cd54236f1cc1","target":{"function":"setInputMethodWithSubtypeIdLocked","file":"services/core/java/com/android/server/inputmethod/InputMethodManagerService.java"},"id":"PUB-A-227207653-18a34f84"},{"digest":{"line_hashes":["62254932137817019122658985252098018523","295964014840922994294226066991664009830","202812284309818429619527170475318128107","176704292464204913468701428427164499249"],"threshold":0.9},"signature_type":"Line","signature_version":"v1","deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/55f6a873458b72b99364d531e9e0cd54236f1cc1","target":{"file":"services/core/java/com/android/server/inputmethod/InputMethodManagerService.java"},"id":"PUB-A-227207653-759353e2"},{"digest":{"function_hash":"307625859859531589155261964946132188509","length":613},"signature_type":"Function","signature_version":"v1","deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/55f6a873458b72b99364d531e9e0cd54236f1cc1","target":{"function":"setInputMethodWithSubtypeIdLocked","file":"services/core/java/com/android/server/inputmethod/InputMethodManagerService.java"},"id":"PUB-A-227207653-908c9be8"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-227207653.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-06-01"}]}],"versions":["13"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ceb9a211ec362d32ca98d7c346667370e7775b32"],"severity":"Moderate","spl":"2023-06-01","vanir_signatures":[{"digest":{"function_hash":"307625859859531589155261964946132188509","length":613},"signature_type":"Function","signature_version":"v1","deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/ceb9a211ec362d32ca98d7c346667370e7775b32","target":{"function":"setInputMethodWithSubtypeIdLocked","file":"services/core/java/com/android/server/inputmethod/InputMethodManagerService.java"},"id":"PUB-A-227207653-31c53218"},{"digest":{"line_hashes":["62254932137817019122658985252098018523","295964014840922994294226066991664009830","202812284309818429619527170475318128107","176704292464204913468701428427164499249"],"threshold":0.9},"signature_type":"Line","signature_version":"v1","deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/ceb9a211ec362d32ca98d7c346667370e7775b32","target":{"file":"services/core/java/com/android/server/inputmethod/InputMethodManagerService.java"},"id":"PUB-A-227207653-8bbbc9ab"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-227207653.json"}}],"schema_version":"1.7.5"}