{"id":"ASB-A-204584366","details":"In queue of UsbRequest.java, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-204584366","CVE-2023-20920"],"modified":"2026-05-21T15:11:38.963146741Z","published":"2023-01-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-01-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/d8e918fc9d479388661e74638d950592af16c001"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2023-01-01"}]}],"versions":["10"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252","signature_version":"v1","signature_type":"Function","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"close"},"deprecated":false,"id":"ASB-A-204584366-0fb3334e","digest":{"length":137,"function_hash":"7269847508204790583515434263233829328"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252","signature_version":"v1","signature_type":"Line","target":{"file":"core/java/android/hardware/usb/UsbRequest.java"},"deprecated":false,"id":"ASB-A-204584366-1806415e","digest":{"line_hashes":["276104590878752660397844813354367309942","172353618839433354333431412538164318901","95659188306839718572831588354300332447","81174342330019458445585225794288420398","83413780435536255958580647457844443009","293719345425021902667665909660676045871","130247754382031353055193230757160205950","152408938682014877718961330328601492680","162884205329918340703727952116933440069","330292456763100805398861730204970328556","79502387876862938617658865185021275675","284502899353952226313921425102556205516","123811250654480706403060173047200929721","134860343233762423206591019317333971400","6153809002853348190614076489219735788","215798567649815907614467130438533073310","76626048380436355668606965215724175700","139727142540396795720220278206414238800","158028791905717405744513745681220166310","315864079412228123039281842188659089958","258325699040201530618297478399631398911","299046539405841758619786188725324980605","149164128577065074663806298752330135910","39896417751151018977369607813445909083","147290932525700798576534658043007295680","213612540297768027605125040485755842497","143296497971704935600314405063123807833"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252","signature_version":"v1","signature_type":"Function","target":{"file":"core/java/android/hardware/usb/UsbDeviceConnection.java","function":"close"},"deprecated":false,"id":"ASB-A-204584366-442de16b","digest":{"length":97,"function_hash":"185997965583041455618509918117696796341"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252","signature_version":"v1","signature_type":"Function","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"queue"},"deprecated":false,"id":"ASB-A-204584366-60de6a61","digest":{"length":662,"function_hash":"182463343494303999816554965884778220659"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252","signature_version":"v1","signature_type":"Function","target":{"file":"core/java/android/hardware/usb/UsbDeviceConnection.java","function":"open"},"deprecated":false,"id":"ASB-A-204584366-7b4a02cc","digest":{"length":227,"function_hash":"289558269005376821094417639689604636205"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252","signature_version":"v1","signature_type":"Line","target":{"file":"core/java/android/hardware/usb/UsbDeviceConnection.java"},"deprecated":false,"id":"ASB-A-204584366-c2bb47ac","digest":{"line_hashes":["225644584700868056746365473993952264490","225516317010957764561976472294732353750","227002822758297823208964377151056791644","38391849955678741051553217843086002921","281439387168020840234618194339149136273","57293824981797575096545126602507004703","76621587704719703869209188865501611282","108074959398907256904588025506263625319","320966007503038203040299508750587661126","307199871166993780345791415484723637514","103948057965550373630226303080849526667","233253399359387248716780084594558982699","189212928265885170423237988826636027541","8866131415284696403577041526688952594","23860540723638293489521692781539987863","249794751009769692010176244246866896178","130247754382031353055193230757160205950","38016763904969071085606916886336715130"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252","signature_version":"v1","signature_type":"Function","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"queue"},"deprecated":false,"id":"ASB-A-204584366-cb8263f3","digest":{"length":1213,"function_hash":"86870526570453178001716111580367832614"}}],"spl":"2023-01-01","types":["EoP"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-204584366.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2023-01-01"}]}],"versions":["11"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061"],"spl":"2023-01-01","vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Line","digest":{"line_hashes":["302643519188408407467161845134839330253","33816863794465726010140598486210879433","336806779166451494666962633279435806148"],"threshold":0.9},"deprecated":false,"id":"ASB-A-204584366-10eb0cce","target":{"file":"core/java/android/hardware/usb/UsbDeviceConnection.java"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Function","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"queue"},"deprecated":false,"id":"ASB-A-204584366-67ea4dc1","digest":{"length":662,"function_hash":"182463343494303999816554965884778220659"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Function","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"queue"},"deprecated":false,"id":"ASB-A-204584366-6c8090b8","digest":{"length":1213,"function_hash":"86870526570453178001716111580367832614"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Function","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"close"},"deprecated":false,"id":"ASB-A-204584366-6eb28f6e","digest":{"length":137,"function_hash":"7269847508204790583515434263233829328"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Line","target":{"file":"core/java/android/hardware/usb/UsbRequest.java"},"deprecated":false,"id":"ASB-A-204584366-b57651ec","digest":{"line_hashes":["276104590878752660397844813354367309942","172353618839433354333431412538164318901","95659188306839718572831588354300332447","81174342330019458445585225794288420398","83413780435536255958580647457844443009","293719345425021902667665909660676045871","130247754382031353055193230757160205950","152408938682014877718961330328601492680","162884205329918340703727952116933440069","330292456763100805398861730204970328556","79502387876862938617658865185021275675","284502899353952226313921425102556205516","123811250654480706403060173047200929721","134860343233762423206591019317333971400","6153809002853348190614076489219735788","215798567649815907614467130438533073310","76626048380436355668606965215724175700","139727142540396795720220278206414238800","158028791905717405744513745681220166310","315864079412228123039281842188659089958","258325699040201530618297478399631398911","299046539405841758619786188725324980605","149164128577065074663806298752330135910","134328666961719536294798562605586728543","21266180863328470844807282855264723075","112452450735683852656670016861322480009","121375302352819018791904056330244634324","244952796154726862282007997045077708923","289577562630712681995631442790426893809","218105067570722703058579066673198055589","238066504475044629330268558432848339028","283390287968524347205917300649824936514","304494702597116108711586962432350718927"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Function","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"cancelIfOpen"},"deprecated":false,"id":"ASB-A-204584366-e0608a58","digest":{"length":248,"function_hash":"294142877403536958019402403444753907027"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Function","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"cancel"},"deprecated":false,"id":"ASB-A-204584366-f6c48b48","digest":{"length":109,"function_hash":"117374267462614018117015717487749567724"}}],"types":["EoP"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-204584366.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2023-01-01"}]}],"versions":["12"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Function","digest":{"length":1213,"function_hash":"86870526570453178001716111580367832614"},"deprecated":false,"id":"ASB-A-204584366-364dc1b9","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"queue"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Function","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"queue"},"deprecated":false,"id":"ASB-A-204584366-4b15cf69","digest":{"length":662,"function_hash":"182463343494303999816554965884778220659"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Line","target":{"file":"core/java/android/hardware/usb/UsbDeviceConnection.java"},"deprecated":false,"id":"ASB-A-204584366-4b837539","digest":{"line_hashes":["302643519188408407467161845134839330253","33816863794465726010140598486210879433","336806779166451494666962633279435806148"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Function","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"cancelIfOpen"},"deprecated":false,"id":"ASB-A-204584366-a92b8e1c","digest":{"length":248,"function_hash":"294142877403536958019402403444753907027"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Line","digest":{"line_hashes":["276104590878752660397844813354367309942","172353618839433354333431412538164318901","95659188306839718572831588354300332447","81174342330019458445585225794288420398","83413780435536255958580647457844443009","293719345425021902667665909660676045871","130247754382031353055193230757160205950","152408938682014877718961330328601492680","162884205329918340703727952116933440069","330292456763100805398861730204970328556","79502387876862938617658865185021275675","284502899353952226313921425102556205516","123811250654480706403060173047200929721","134860343233762423206591019317333971400","6153809002853348190614076489219735788","215798567649815907614467130438533073310","76626048380436355668606965215724175700","139727142540396795720220278206414238800","158028791905717405744513745681220166310","315864079412228123039281842188659089958","258325699040201530618297478399631398911","299046539405841758619786188725324980605","149164128577065074663806298752330135910","134328666961719536294798562605586728543","21266180863328470844807282855264723075","112452450735683852656670016861322480009","121375302352819018791904056330244634324","244952796154726862282007997045077708923","289577562630712681995631442790426893809","218105067570722703058579066673198055589","238066504475044629330268558432848339028","283390287968524347205917300649824936514","304494702597116108711586962432350718927"],"threshold":0.9},"deprecated":false,"id":"ASB-A-204584366-ce1d5bed","target":{"file":"core/java/android/hardware/usb/UsbRequest.java"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Function","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"close"},"deprecated":false,"id":"ASB-A-204584366-cf41299c","digest":{"length":137,"function_hash":"7269847508204790583515434263233829328"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Function","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"cancel"},"deprecated":false,"id":"ASB-A-204584366-eb390c2a","digest":{"length":109,"function_hash":"117374267462614018117015717487749567724"}}],"spl":"2023-01-01","types":["EoP"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-204584366.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2023-01-01"}]}],"versions":["12L"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Function","digest":{"length":137,"function_hash":"7269847508204790583515434263233829328"},"deprecated":false,"id":"ASB-A-204584366-000e65ed","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"close"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Line","digest":{"line_hashes":["302643519188408407467161845134839330253","33816863794465726010140598486210879433","336806779166451494666962633279435806148"],"threshold":0.9},"deprecated":false,"id":"ASB-A-204584366-32177294","target":{"file":"core/java/android/hardware/usb/UsbDeviceConnection.java"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Function","digest":{"length":109,"function_hash":"117374267462614018117015717487749567724"},"deprecated":false,"id":"ASB-A-204584366-490dfeeb","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"cancel"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Function","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"cancelIfOpen"},"deprecated":false,"id":"ASB-A-204584366-a126e721","digest":{"length":248,"function_hash":"294142877403536958019402403444753907027"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Function","digest":{"length":662,"function_hash":"182463343494303999816554965884778220659"},"deprecated":false,"id":"ASB-A-204584366-d164fc3a","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"queue"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Line","digest":{"line_hashes":["276104590878752660397844813354367309942","172353618839433354333431412538164318901","95659188306839718572831588354300332447","81174342330019458445585225794288420398","83413780435536255958580647457844443009","293719345425021902667665909660676045871","130247754382031353055193230757160205950","152408938682014877718961330328601492680","162884205329918340703727952116933440069","330292456763100805398861730204970328556","79502387876862938617658865185021275675","284502899353952226313921425102556205516","123811250654480706403060173047200929721","134860343233762423206591019317333971400","6153809002853348190614076489219735788","215798567649815907614467130438533073310","76626048380436355668606965215724175700","139727142540396795720220278206414238800","158028791905717405744513745681220166310","315864079412228123039281842188659089958","258325699040201530618297478399631398911","299046539405841758619786188725324980605","149164128577065074663806298752330135910","134328666961719536294798562605586728543","21266180863328470844807282855264723075","112452450735683852656670016861322480009","121375302352819018791904056330244634324","244952796154726862282007997045077708923","289577562630712681995631442790426893809","218105067570722703058579066673198055589","238066504475044629330268558432848339028","283390287968524347205917300649824936514","304494702597116108711586962432350718927"],"threshold":0.9},"deprecated":false,"id":"ASB-A-204584366-fc5b6a04","target":{"file":"core/java/android/hardware/usb/UsbRequest.java"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Function","digest":{"length":1213,"function_hash":"86870526570453178001716111580367832614"},"deprecated":false,"id":"ASB-A-204584366-fe529ce6","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"queue"}}],"spl":"2023-01-01","types":["EoP"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-204584366.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-01-01"}]}],"versions":["13"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Line","target":{"file":"core/java/android/hardware/usb/UsbDeviceConnection.java"},"deprecated":false,"id":"ASB-A-204584366-060ec929","digest":{"line_hashes":["302643519188408407467161845134839330253","33816863794465726010140598486210879433","336806779166451494666962633279435806148"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Function","digest":{"length":109,"function_hash":"117374267462614018117015717487749567724"},"deprecated":false,"id":"ASB-A-204584366-499f09d4","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"cancel"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Function","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"queue"},"deprecated":false,"id":"ASB-A-204584366-6b9a33f2","digest":{"length":1213,"function_hash":"86870526570453178001716111580367832614"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Line","target":{"file":"core/java/android/hardware/usb/UsbRequest.java"},"deprecated":false,"id":"ASB-A-204584366-7cc03009","digest":{"line_hashes":["276104590878752660397844813354367309942","172353618839433354333431412538164318901","95659188306839718572831588354300332447","81174342330019458445585225794288420398","83413780435536255958580647457844443009","293719345425021902667665909660676045871","130247754382031353055193230757160205950","152408938682014877718961330328601492680","162884205329918340703727952116933440069","330292456763100805398861730204970328556","79502387876862938617658865185021275675","284502899353952226313921425102556205516","123811250654480706403060173047200929721","134860343233762423206591019317333971400","6153809002853348190614076489219735788","215798567649815907614467130438533073310","76626048380436355668606965215724175700","139727142540396795720220278206414238800","158028791905717405744513745681220166310","315864079412228123039281842188659089958","258325699040201530618297478399631398911","299046539405841758619786188725324980605","149164128577065074663806298752330135910","134328666961719536294798562605586728543","21266180863328470844807282855264723075","112452450735683852656670016861322480009","121375302352819018791904056330244634324","244952796154726862282007997045077708923","289577562630712681995631442790426893809","218105067570722703058579066673198055589","238066504475044629330268558432848339028","283390287968524347205917300649824936514","304494702597116108711586962432350718927"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Function","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"close"},"deprecated":false,"id":"ASB-A-204584366-bbb8789e","digest":{"length":137,"function_hash":"7269847508204790583515434263233829328"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Function","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"cancelIfOpen"},"deprecated":false,"id":"ASB-A-204584366-c35ff623","digest":{"length":248,"function_hash":"294142877403536958019402403444753907027"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","signature_version":"v1","signature_type":"Function","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"queue"},"deprecated":false,"id":"ASB-A-204584366-ee1d999e","digest":{"length":662,"function_hash":"182463343494303999816554965884778220659"}}],"spl":"2023-01-01","types":["EoP"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-204584366.json"}}],"schema_version":"1.7.5"}