UPDATED – Google Android OS Could Allow for Remote Code Execution – PATCH NOW – TLP: CLEAR

TLP: CLEAR

MS-ISAC CYBERSECURITY ADVISORY

MS-ISAC ADVISORY NUMBER:

2023-117 – UPDATED

DATE(S) ISSUED:
10/05/2023

10/09/2023 – UPDATED

SUBJECT:
Multiple Vulnerabilities in Google Android OS Could Allow for Remote Code Execution

OVERVIEW:
Multiple vulnerabilities have been discovered in Google Android OS, the most severe of which could allow for remote code execution. Android is an operating system developed by Google for mobile devices, including, but not limited to, smartphones, tablets, and watches. Successful exploitation of the most severe of these vulnerabilities could allow for remote code execution. Depending on the privileges associated with the exploited component, an attacker could then install programs; view, change, or delete data; or create new accounts with full rights.

October 9th – UPDATED OVERVIEW:

Google Android has released Android 14 with a new set of remote code execution vulnerabilities.

THREAT INTELLIGENCE:

There are reports of these vulnerabilities being exploited in the wild. (CVE-2023-4863, CVE-2023-4211)

SYSTEMS AFFECTED:

Android OS patch levels prior to 2023-10-05

October 9^th – UPDATED SYSTEMS AFFECTED:

Android 14 patch levels prior to 2023-10-01

RISK:

Government:

Large and medium government entities: High
Small government entities: Medium

Businesses:

Large and medium business entities: High
Small business entities: Medium

Home users: Low

TECHNICAL SUMMARY:
Multiple vulnerabilities have been discovered in Google Android OS, the most severe of which could allow for remote code execution in the context of the affected component. Following the MITRE ATT&CK framework, exploitation of these vulnerabilities can be classified as follows:

Tactic: Execution (TA0002)

Technique: Exploitation for Client Execution (T1203):

Multiple vulnerabilities in System that could allow for remote code execution. (CVE-2023-40129, CVE-2023-4863)
A vulnerability in Media Framework that could allow for remote code execution. (CVE-2023-21282)
A vulnerability in System that could allow for remote code execution. (CVE-2023-21273)
Multiple vulnerabilities in Qualcomm closed-source components that could allow for remote code execution (CVE-2023-24855, CVE-2023-28540, CVE-2023-33028)

Details of lower-severity vulnerabilities are as follows:

Multiple vulnerabilities in Framework that could allow for escalation of privilege. (CVE-2023-21266, CVE-2023-40116, CVE-2023-40120, CVE-2023-40131, CVE-2023-40140)
Multiple vulnerabilities in Framework that could allow for information disclosure. (CVE-2023-21291, CVE-2023-40121, CVE-2023-40134, CVE-2023-40136, CVE-2023-40137, CVE-2023-40138, CVE-2023-40139)
Multiple vulnerabilities in System that could allow for escalation of privilege. (CVE-2023-21244, CVE-2023-40117, CVE-2023-40125, CVE-2023-40128, CVE-2023-40130 )
Multiple vulnerabilities in System that could allow for information disclosure. (CVE-2023-40123, CVE-2023-40127, CVE-2023-40133, CVE-2023-40135)
Multiple vulnerabilities in System that could allow for denial of service. (CVE-2023-21252 , CVE-2023-21253)
Multiple vulnerabilities in Project Mainline components. (CVE-2023-21282, CVE-2023-21132, CVE-2023-21133, CVE-2023-21134, CVE-2023-21140, CVE-2023-20965, CVE-2023-21242)
Multiple vulnerabilities in Kernel that could allow for escalation of privilege. (CVE-2023-21264, CVE-2020-29374)
Multiple vulnerabilities in Arm components. (CVE-2021-44828, CVE-2022-28348, CVE-2023-4211, CVE-2023-33200, CVE-2023-34970)
Multiple vulnerabilities in MediaTek components. (CVE-2023-20819, CVE-2023-32819, CVE-2023-32820)
A vulnerability in Unisoc components. (CVE-2023-40638)
Multiple vulnerabilities in Qualcomm components. (CVE-2023-33029, CVE-2023-33034, CVE-2023-33035)
Multiple vulnerabilities in Qualcomm closed-source components (CVE-2023-21673, CVE-2023-22385, CVE-2023-24843, CVE-2023-24844, CVE-2023-24847, CVE-2023-24848, CVE-2023-24849, CVE-2023-24850, CVE-2023-24853, CVE-2023-33026, CVE-2023-33027)

Successful exploitation of the most severe of these vulnerabilities could allow for remote code execution. Depending on the privileges associated with the exploited component, an attacker could then install programs; view, change, or delete data; or create new accounts with full rights.

October 9th – UPDATED TECHNICAL SUMMARY:

Multiple vulnerabilities have been discovered in Google Android 14, the most severe of which could allow for remote code execution in the context of the affected component. Following the MITRE ATT&CK framework, exploitation of these vulnerabilities can be classified as follows:

Tactic: Execution (TA0002)

Technique: Exploitation for Client Execution (T1203):

Multiple vulnerabilities in System could allow for remote code execution. (CVE-2023-21356)

Details of lower-severity vulnerabilities are as follows:

Multiple vulnerabilities in Android runtime that could allow for escalation of privilege. (CVE-2022-29824, CVE-2023-21372)
Multiple vulnerabilities in Android runtime that could allow for information disclosure. (CVE-2023-21309, CVE-2023-21366, CVE-2023-21367, CVE-2023-40101)
Multiple vulnerabilities in Framework could allow for escalation of privilege. (CVE-2023-21342, CVE-2023-21343, CVE-2023-21351, CVE-2023-21398, CVE-2023-21298, CVE-2023-21324, CVE-2023-21328, CVE-2023-21337, CVE-2023-21338, CVE-2023-21341, CVE-2023-21397, CVE-2023-21374)
Multiple vulnerabilities in Framework could allow for denial of service. (CVE-2023-21362, CVE-2023-21364, CVE-2023-21365, CVE-2023-21339)
Multiple vulnerabilities in Framework could allow for information disclosure. (CVE-2022-20264, CVE-2022-27404, CVE-2023-21293, CVE-2023-21294, CVE-2023-21295, CVE-2023-21296, CVE-2023-21299, CVE-2023-21300, CVE-2023-21301, CVE-2023-21302, CVE-2023-21304, CVE-2023-21303, CVE-2023-21304, CVE-2023-21305, CVE-2023-21316, CVE-2023-21306, CVE-2023-21317, CVE-2023-21318, CVE-2023-21319, CVE-2023-21320, CVE-2023-21323, CVE-2023-21321, CVE-2023-21326, CVE-2023-21327, CVE-2023-21329, CVE-2023-21330, CVE-2023-21331, CVE-2023-21332, CVE-2023-21333, CVE-2023-21334, CVE-2023-21336,CVE-2023-21344, CVE-2023-21346, CVE-2023-21348, CVE-2023-21349, CVE-2023-21354, CVE-2023-21377, CVE-2023-21382, CVE-2023-21387, CVE-2023-21345)
Multiple vulnerabilities in Media Framework could allow for escalation of privilege. (CVE-2023-21381, CVE-2023-21355)
Multiple vulnerabilities in System could allow for escalation of privilege. (CVE-2021-39810, CVE-2023-21313, CVE-2023-21358, CVE-2023-21361, CVE-2023-21392, CVE-2023-21310, CVE-2023-21360, CVE-2023-21370, CVE-2023-21371, CVE-2023-21373, CVE-2023-21375, CVE-2023-21376, CVE-2023-21378, CVE-2023-21380, CVE-2023-21388, CVE-2023-21389, CVE-2023-21390, CVE-2023-21393, CVE-2023-21396)
Multiple vulnerabilities in System could allow for denial of service. (CVE-2023-21311, CVE-2023-21369, CVE-2023-21391)
Multiple vulnerabilities in System could allow for information disclosure. (CVE-2023-21312, CVE-2023-21315, CVE-2023-21394, CVE-2022-20531, CVE-2023-21308, CVE-2023-21314, CVE-2023-21325, CVE-2023-21335, CVE-2023-21340, CVE-2023-21347, CVE-2023-21350, CVE-2023-21352, CVE-2023-21353, CVE-2023-21357, CVE-2023-21359, CVE-2023-21368, CVE-2023-21379, CVE-2023-21383, CVE-2023-21384, CVE-2023-21385, CVE-2023-21395, CVE-2023-21386, CVE-2023-21297, CVE-2023-21307)

RECOMMENDATIONS:
We recommend the following actions be taken:

Apply the stable channel update provided by Google to vulnerable systems immediately after appropriate testing. (M1051: Update Software)
- Safeguard 7.1 : Establish and Maintain a Vulnerability Management Process: Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.
- Safeguard 7.2 : Establish and Maintain a Remediation Process: Establish and maintain a risk-based remediation strategy documented in a remediation process, with monthly, or more frequent, reviews.
- Safeguard 7.6 : Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets: Perform automated vulnerability scans of externally-exposed enterprise assets using a SCAP-compliant vulnerability scanning tool. Perform scans on a monthly, or more frequent, basis.
- Safeguard 7.7 : Remediate Detected Vulnerabilities: Remediate detected vulnerabilities in software through processes and tooling on a monthly, or more frequent, basis, based on the remediation process.
- Safeguard 16.13 Conduct Application Penetration Testing: Conduct application penetration testing. For critical applications, authenticated penetration testing is better suited to finding business logic vulnerabilities than code scanning and automated security testing. Penetration testing relies on the skill of the tester to manually manipulate an application as an authenticated and unauthenticated user.
- Safeguard 18.1 : Establish and Maintain a Penetration Testing Program: Establish and maintain a penetration testing program appropriate to the size, complexity, and maturity of the enterprise. Penetration testing program characteristics include scope, such as network, web application, Application Programming Interface (API), hosted services, and physical premise controls; frequency; limitations, such as acceptable hours, and excluded attack types; point of contact information; remediation, such as how findings will be routed internally; and retrospective requirements.
- Safeguard 18.2 : Perform Periodic External Penetration Tests: Perform periodic external penetration tests based on program requirements, no less than annually. External penetration testing must include enterprise and environmental reconnaissance to detect exploitable information. Penetration testing requires specialized skills and experience and must be conducted through a qualified party. The testing may be clear box or opaque box.
- Safeguard 18.3 : Remediate Penetration Test Findings: Remediate penetration test findings based on the enterprise’s policy for remediation scope and prioritization.
Restrict execution of code to a virtual environment on or in transit to an endpoint system. (M1048: Application Isolation and Sandboxing)
- Safeguard 4.1 : Establish and Maintain a Secure Configuration Process: Establish and maintain a secure configuration process for enterprise assets (end-user devices, including portable and mobile, non-computing/IoT devices, and servers) and software (operating systems and applications). Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.
- Safeguard 16.8: Separate Production and Non-Production Systems: Maintain separate environments for production and non-production systems.
Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring. (M1050: Exploit Protection)
- Safeguard 10.5: Enable Anti-Exploitation Features: Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data Execution Prevention (DEP), Windows® Defender Exploit Guard (WDEG), or Apple® System Integrity Protection (SIP) and Gatekeeper™.
- Safeguard 13.10 : Perform Application Layer Filtering: Perform application layer filtering. Example implementations include a filtering proxy, application layer firewall, or gateway.

REFERENCES:

Google:
https://source.android.com/docs/security/bulletin/2023-10-01

MediaTek:
https://corp.mediatek.com/product-security-bulletin/October-2023

Unisoc:
https://www.cybersecurity-help.cz/vdb/SB2023100252

Qualcomm:
https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2023-bulletin.html

CVE:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29374
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44828
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4211
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4863
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28348
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20819
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20965
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21132
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21133
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21134
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21140
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21242
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21244
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21252
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21253
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21264
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21266
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21273
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21282
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21291
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21673
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22385
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24843
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24844
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24847
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24848
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24849
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24850
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24853
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24855
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28540
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32819
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32820
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33026
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33027
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33028
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33029
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33034
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33035
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33200
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34970
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40116
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40117
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40120
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40121
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40123
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40125
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40127
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40128
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40129
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40130
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40131
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40133
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40134
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40135
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40136
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40137
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40138
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40139
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40140
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40638

October 9th – UPDATED REFERENCES:

Google:
https://source.android.com/docs/security/bulletin/android-14#android-runtime

CVE:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29824
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21309
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21366
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21367
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21372
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40101
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21342
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21343
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21351
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21398
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21362
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21364
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21365
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21298
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21324
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21328
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21337
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21338
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21341
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21374
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21397
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20264
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27404
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21293
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21294
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21295
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21296
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21299
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21300
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21301
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21302
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21303
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21304
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21305
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21306
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21316
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21317
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21318
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21319
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21320
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21321
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21323
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21326
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21327
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21329
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21330
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21331
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21332
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21333
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21334
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21336
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21344
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21346
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21348
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21349
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21354
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21377
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21382
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21387
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21339
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21345
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21381
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21355
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39810
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21313
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21358
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21361
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21392
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21312
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21315
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21394
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21356
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21310
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21360
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21370
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21371
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21373
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21375
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21376
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21378
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21380
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21388
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21389
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21390
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21393
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21396
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20531
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21308
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21314
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21325
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21335
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21340
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21347
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21350
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21352
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21353
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21357
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21359
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21368
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21379
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21383
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21384
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21385
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21395
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21311
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21369
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21391
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21386
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21297
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21307

Multi-State Information Sharing and Analysis Center (MS-ISAC)
Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC)
31 Tech Valley Drive
East Greenbush, NY 12061

24×7 Security Operations Center
SOC@cisecurity.org – 1-866-787-4722

TLP:CLEAR
www.cisa.gov/tlp
Information may be distributed without restriction, subject to standard copyright rules.

Center for Internet Security

Northeast Headquarters | 31 Tech Valley Drive | East Greenbush, NY 12061 | Phone: 518-266-3460