What is the CVSS score of CVE-2023-22808?

CVE-2023-22808 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Avalon Android Gralloc Module CVE-2023-22808

LOW

Out-of-bounds Read (CWE-125)

2023-04-11 cve@mitre.org

Buffer Overflow Information Disclosure Google Avalon Android Gralloc Module Bifrost Android Gralloc Module Valhall Android Gralloc Module

3.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Apr 11, 2023 - 21:15 nvd

LOW 3.3

DescriptionNVD

An issue was discovered in the Arm Android Gralloc Module. A non-privileged user can read a small portion of the allocator process memory. This affects Bifrost r24p0 through r41p0 before r42p0, Valhall r24p0 through r41p0 before r42p0, and Avalon r41p0 before r42p0.

AnalysisAI

An issue was discovered in the Arm Android Gralloc Module. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Out-of-bounds Read (CWE-125), which allows attackers to read data from memory outside the intended buffer boundaries. An issue was discovered in the Arm Android Gralloc Module. A non-privileged user can read a small portion of the allocator process memory. This affects Bifrost r24p0 through r41p0 before r42p0, Valhall r24p0 through r41p0 before r42p0, and Avalon r41p0 before r42p0. Affected products include: Arm Avalon Android Gralloc Module, Arm Bifrost Android Gralloc Module, Arm Valhall Android Gralloc Module.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate array indices and buffer lengths. Use memory-safe languages. Enable AddressSanitizer during testing.