CVE-2023-40074

What it actually does

Invalid data passed to saveToXml in PersistableBundle.java causes persistent local denial of service by corrupting persistent state without requiring additional privileges or user interaction.

Why it matters to the business

Affected Android devices may become unusable until reset or restored, leading to downtime for users and organizations relying on mobile devices for operations.

How an attack unfolds

An attacker with local access on an Android device supplies crafted invalid data to PersistableBundle saveToXml, triggering a persistent DoS condition that survives reboots and requires no further privileges.

How to fix it

Apply the latest Android security patches from device vendors as soon as they become available; monitor for updates addressing PersistableBundle handling.

How to confirm the fix worked

Confirm the device is running a patched Android build by checking the security patch level in settings; test PersistableBundle serialization with known invalid inputs in a lab environment to verify DoS is prevented.

Typical attack path

1. Obtain local access on a target Android device
2. Identify or create an application or component that invokes PersistableBundle.saveToXml with attacker-controlled data
3. Supply invalid data that triggers the flaw during XML serialization
4. Persist the corrupted state to achieve denial of service across reboots

How to detect it

Review device logs for repeated failures during bundle serialization or XML persistence operations; look for crash reports or stability issues tied to system components handling PersistableBundle data.

What your security team should do

• Prioritize deployment of Android security updates across managed devices
• Monitor vendor announcements for fixes related to this DoS issue
• Limit local application installation privileges where possible to reduce attack surface