{"id":"PUB-A-227207653","details":"In setInputMethodWithSubtypeIdLocked of InputMethodManagerService.java, there is a possible way to setup input methods that are not enabled due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-227207653","CVE-2023-21192"],"modified":"2026-09-22T15:22:15.314525410Z","published":"2023-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-06-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13-next:0"},{"fixed":"13-next:2023-06-01"}]}],"versions":["13-next"],"ecosystem_specific":{"severity":"Moderate","spl":"2023-06-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/55f6a873458b72b99364d531e9e0cd54236f1cc1","target":{"file":"services/core/java/com/android/server/inputmethod/InputMethodManagerService.java"},"deprecated":false,"digest":{"line_hashes":["62254932137817019122658985252098018523","295964014840922994294226066991664009830","202812284309818429619527170475318128107","176704292464204913468701428427164499249"],"threshold":0.9},"id":"PUB-A-227207653-15ca8a0b","signature_type":"Line"},{"digest":{"function_hash":"307625859859531589155261964946132188509","length":613},"id":"PUB-A-227207653-18a34f84","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/55f6a873458b72b99364d531e9e0cd54236f1cc1","target":{"function":"setInputMethodWithSubtypeIdLocked","file":"services/core/java/com/android/server/inputmethod/InputMethodManagerService.java"},"deprecated":false},{"id":"PUB-A-227207653-759353e2","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/55f6a873458b72b99364d531e9e0cd54236f1cc1","target":{"file":"services/core/java/com/android/server/inputmethod/InputMethodManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["62254932137817019122658985252098018523","295964014840922994294226066991664009830","202812284309818429619527170475318128107","176704292464204913468701428427164499249"]}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/55f6a873458b72b99364d531e9e0cd54236f1cc1","target":{"function":"setInputMethodWithSubtypeIdLocked","file":"services/core/java/com/android/server/inputmethod/InputMethodManagerService.java"},"deprecated":false,"digest":{"function_hash":"307625859859531589155261964946132188509","length":613},"id":"PUB-A-227207653-908c9be8"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/55f6a873458b72b99364d531e9e0cd54236f1cc1","https://android.googlesource.com/platform/frameworks/base/+/55f6a873458b72b99364d531e9e0cd54236f1cc1"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-227207653.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-06-01"}]}],"versions":["13"],"ecosystem_specific":{"spl":"2023-06-01","types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"307625859859531589155261964946132188509","length":613},"id":"PUB-A-227207653-31c53218","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ceb9a211ec362d32ca98d7c346667370e7775b32","target":{"file":"services/core/java/com/android/server/inputmethod/InputMethodManagerService.java","function":"setInputMethodWithSubtypeIdLocked"},"deprecated":false},{"target":{"file":"services/core/java/com/android/server/inputmethod/InputMethodManagerService.java"},"deprecated":false,"digest":{"line_hashes":["62254932137817019122658985252098018523","295964014840922994294226066991664009830","202812284309818429619527170475318128107","176704292464204913468701428427164499249"],"threshold":0.9},"id":"PUB-A-227207653-8bbbc9ab","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ceb9a211ec362d32ca98d7c346667370e7775b32"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ceb9a211ec362d32ca98d7c346667370e7775b32"],"severity":"Moderate"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-227207653.json"}}],"schema_version":"1.9.0"}