Security readout for executives and security teams
Plain-English summary
CVE-2023-33897 is a Unisoc Android radio-interface library issue. A missing bounds check may allow an out-of-bounds write, leading to local denial of service. The source states System execution privileges are needed, so the immediate risk appears limited to already highly privileged local contexts. Public severity, CVSS, and patch details are not provided.
Executive priority
Treat this as a targeted device-firmware exposure rather than an internet-scale emergency. Prioritize asset identification and OEM update tracking, especially for managed Android fleets using Unisoc chipsets. Business urgency is constrained by sparse public detail and the stated need for System privileges.
Technical view
The flaw is in libimpl-ril on listed Unisoc chipsets running Android 10 through Android 13. The CVE describes a missing bounds check causing a possible out-of-bounds write. The documented impact is local denial of service with System execution privileges required. No CWE, CVSS vector, trigger conditions, or fix identifier is available in the supplied sources.
Likely exposure
Exposure is most likely in Android devices using the listed Unisoc chipsets and Android 10, 11, 12, or 13. Product mapping must be done through device BOMs, firmware inventories, or OEM security notices because the source names chipsets and Android versions, not retail device models.
Exploitation context
The provided sources do not indicate active exploitation, public exploit availability, or KEV listing. The described prerequisite is local access with System execution privileges, which suggests exploitation would require a compromised or highly privileged local context. Operational concern is denial of service in affected radio-interface components.
Researcher notes
Key gaps remain: no CVSS, CWE, patch identifier, vulnerable build range, trigger path, or exploit evidence is included. Analysis should stay bounded to the listed Unisoc chipsets, Android 10 through 13, libimpl-ril, local denial of service, and System-privilege prerequisite.
Mitigation direction
- Check Unisoc and device OEM advisories for firmware or security update guidance.
- Prioritize updates for affected chipsets running Android 10 through Android 13.
- Identify business-owned Android devices using listed Unisoc chipsets.
- Restrict unmanaged apps and local administrative access on potentially affected devices.
- Monitor OEM bulletins for patch identifiers or updated severity information.
Validation and detection
- Map device models to Unisoc chipset and Android version inventories.
- Confirm whether firmware contains the affected libimpl-ril component.
- Review OEM patch level and Unisoc advisory status for each device family.
- Check mobile management data for affected Android 10 through 13 assets.
- Track unexplained radio, telephony, or system-service crashes on affected devices.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-33897 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.unisoc.com/en_us/secy/announcementDetail/1676902764208259073CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.