Every CVE Search/ Get API key

CVE-2023-21034

In multiple functions of SensorService.cpp, there is a possible access of accurate sensor data...

7.8 HighFix available

In multiple functions of SensorService.cpp, there is a possible access of accurate sensor data due to a permissions bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-230358834

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.11%Up 0.1 points since Mar 25, 2023
90%50%10%1%

What each source reports

NVD Score used 7.8

In multiple functions of SensorService.cpp, there is a possible access of accurate sensor data due to a permissions bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-230358834

Record
CVE-2023-21034
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-863
Updated
2026-11-02
CVE List 7.8

In multiple functions of SensorService.cpp, there is a possible access of accurate sensor data due to a permissions bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-230358834

Record
CVE-2023-21034
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-863
Updated
2026-11-02
EUVDEUVD-2023-25202 7.8

In multiple functions of SensorService.cpp, there is a possible access of accurate sensor data due to a permissions bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-230358834

Record
EUVD-2023-25202
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-q8wp-g4vf-63p9 7.8

In multiple functions of SensorService.cpp, there is a possible access of accurate sensor data...

In multiple functions of SensorService.cpp, there is a possible access of accurate sensor data due to a permissions bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-230358834

Record
GHSA-q8wp-g4vf-63p9
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-863
Updated
2026-11-02
OSVUBUNTU-CVE-2023-21034 7.8

In multiple functions of SensorService.cpp, there is a possible access of accurate sensor data due to a permissions bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-230358834

Record
UBUNTU-CVE-2023-21034
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVPUB-A-230358834 No score

In multiple functions of SensorService.cpp, there is a possible access of accurate sensor data due to a permissions bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

Record
PUB-A-230358834
Updated
2026-11-05

Affected products

Affected packages

Affected packages
PackageAffectedFixed
platform/frameworks/native
Android
13:0 up to 13:2023-03-01, plus listed versions
13
13:2023-03-01
android-platform-tools
Ubuntu:22.04:LTS
All versions, plus listed versions
29.0.6-329.0.6-429.0.6-4ubuntu1
None known
android-platform-tools
Ubuntu:24.04:LTS
All versions, plus listed versions
33.0.3-234.0.4-1build234.0.4-1build3
None known

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-21034 is a high vulnerability (CVSS 7.8) in Google Android, published March 1, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. Fixed in platform/frameworks/native 13:2023-03-01.

References

MoveEnter Open