CVE-2023-21102

What it actually does

Logic error in __efi_rt_asm_wrapper of efi-rt-wrapper.S allows bypass of shadow stack protection, enabling local privilege escalation on the Android kernel.

Why it matters to the business

Attackers with local access on affected Android devices can elevate privileges to gain full system control, increasing risk of data theft or persistence on devices that remain unpatched after 1250 days since disclosure.

How an attack unfolds

An attacker with local execution on an Android device triggers the logic error in the EFI runtime assembly wrapper to bypass shadow stack protections and escalate privileges without user interaction; exploit code is publicly available though EPSS remains low and stable.

How to fix it

Update the Android kernel to incorporate upstream fixes addressing the logic error in efi-rt-wrapper.S; monitor Google security bulletins for kernel patches and apply device firmware updates as they become available.

How to confirm the fix worked

Verify kernel source for corrected __efi_rt_asm_wrapper implementation, confirm shadow stack protection remains intact under test conditions, and validate device updates against Android security patch levels.

Typical attack path

1. Obtain local code execution on target Android device
2. Invoke __efi_rt_asm_wrapper with crafted parameters to trigger logic error
3. Bypass shadow stack protection mechanism
4. Escalate to higher privilege context
5. Execute arbitrary code with elevated permissions

How to detect it

Examine kernel logs and audit trails for anomalous calls involving EFI runtime services; look for unexpected privilege changes or shadow stack violations in system event records.

What your security team should do

• Prioritize kernel updates on all Android devices given public exploit availability
• Review device update policies to reduce exposure window beyond 1250 days
• Monitor for any increase in EPSS or KEV inclusion
• Harden local access controls where kernel updates are delayed