{"id":"ASB-A-204584366","details":"In queue of UsbRequest.java, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-204584366","CVE-2023-20920"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2023-01-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-01-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/d8e918fc9d479388661e74638d950592af16c001"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2023-01-01"}]}],"versions":["10"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252"],"severity":"High","spl":"2023-01-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"close"},"deprecated":false,"digest":{"length":137,"function_hash":"7269847508204790583515434263233829328"},"id":"ASB-A-204584366-0fb3334e","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252","target":{"file":"core/java/android/hardware/usb/UsbRequest.java"},"deprecated":false,"digest":{"line_hashes":["276104590878752660397844813354367309942","172353618839433354333431412538164318901","95659188306839718572831588354300332447","81174342330019458445585225794288420398","83413780435536255958580647457844443009","293719345425021902667665909660676045871","130247754382031353055193230757160205950","152408938682014877718961330328601492680","162884205329918340703727952116933440069","330292456763100805398861730204970328556","79502387876862938617658865185021275675","284502899353952226313921425102556205516","123811250654480706403060173047200929721","134860343233762423206591019317333971400","6153809002853348190614076489219735788","215798567649815907614467130438533073310","76626048380436355668606965215724175700","139727142540396795720220278206414238800","158028791905717405744513745681220166310","315864079412228123039281842188659089958","258325699040201530618297478399631398911","299046539405841758619786188725324980605","149164128577065074663806298752330135910","39896417751151018977369607813445909083","147290932525700798576534658043007295680","213612540297768027605125040485755842497","143296497971704935600314405063123807833"],"threshold":0.9},"id":"ASB-A-204584366-1806415e"},{"target":{"file":"core/java/android/hardware/usb/UsbDeviceConnection.java","function":"close"},"deprecated":false,"digest":{"length":97,"function_hash":"185997965583041455618509918117696796341"},"id":"ASB-A-204584366-442de16b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252"},{"target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"queue"},"deprecated":false,"digest":{"length":662,"function_hash":"182463343494303999816554965884778220659"},"id":"ASB-A-204584366-60de6a61","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252","target":{"function":"open","file":"core/java/android/hardware/usb/UsbDeviceConnection.java"},"deprecated":false,"digest":{"function_hash":"289558269005376821094417639689604636205","length":227},"id":"ASB-A-204584366-7b4a02cc"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252","target":{"file":"core/java/android/hardware/usb/UsbDeviceConnection.java"},"deprecated":false,"digest":{"line_hashes":["225644584700868056746365473993952264490","225516317010957764561976472294732353750","227002822758297823208964377151056791644","38391849955678741051553217843086002921","281439387168020840234618194339149136273","57293824981797575096545126602507004703","76621587704719703869209188865501611282","108074959398907256904588025506263625319","320966007503038203040299508750587661126","307199871166993780345791415484723637514","103948057965550373630226303080849526667","233253399359387248716780084594558982699","189212928265885170423237988826636027541","8866131415284696403577041526688952594","23860540723638293489521692781539987863","249794751009769692010176244246866896178","130247754382031353055193230757160205950","38016763904969071085606916886336715130"],"threshold":0.9},"id":"ASB-A-204584366-c2bb47ac","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"queue"},"deprecated":false,"digest":{"function_hash":"86870526570453178001716111580367832614","length":1213},"id":"ASB-A-204584366-cb8263f3","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-204584366.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2023-01-01"}]}],"versions":["11"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061"],"severity":"High","spl":"2023-01-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"core/java/android/hardware/usb/UsbDeviceConnection.java"},"deprecated":false,"digest":{"line_hashes":["302643519188408407467161845134839330253","33816863794465726010140598486210879433","336806779166451494666962633279435806148"],"threshold":0.9},"id":"ASB-A-204584366-10eb0cce","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061"},{"id":"ASB-A-204584366-67ea4dc1","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"queue"},"deprecated":false,"digest":{"length":662,"function_hash":"182463343494303999816554965884778220659"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","target":{"function":"queue","file":"core/java/android/hardware/usb/UsbRequest.java"},"deprecated":false,"digest":{"length":1213,"function_hash":"86870526570453178001716111580367832614"},"id":"ASB-A-204584366-6c8090b8"},{"id":"ASB-A-204584366-6eb28f6e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"close"},"deprecated":false,"digest":{"function_hash":"7269847508204790583515434263233829328","length":137}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","target":{"file":"core/java/android/hardware/usb/UsbRequest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["276104590878752660397844813354367309942","172353618839433354333431412538164318901","95659188306839718572831588354300332447","81174342330019458445585225794288420398","83413780435536255958580647457844443009","293719345425021902667665909660676045871","130247754382031353055193230757160205950","152408938682014877718961330328601492680","162884205329918340703727952116933440069","330292456763100805398861730204970328556","79502387876862938617658865185021275675","284502899353952226313921425102556205516","123811250654480706403060173047200929721","134860343233762423206591019317333971400","6153809002853348190614076489219735788","215798567649815907614467130438533073310","76626048380436355668606965215724175700","139727142540396795720220278206414238800","158028791905717405744513745681220166310","315864079412228123039281842188659089958","258325699040201530618297478399631398911","299046539405841758619786188725324980605","149164128577065074663806298752330135910","134328666961719536294798562605586728543","21266180863328470844807282855264723075","112452450735683852656670016861322480009","121375302352819018791904056330244634324","244952796154726862282007997045077708923","289577562630712681995631442790426893809","218105067570722703058579066673198055589","238066504475044629330268558432848339028","283390287968524347205917300649824936514","304494702597116108711586962432350718927"]},"id":"ASB-A-204584366-b57651ec","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"294142877403536958019402403444753907027","length":248},"id":"ASB-A-204584366-e0608a58","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"cancelIfOpen"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"cancel"},"deprecated":false,"digest":{"function_hash":"117374267462614018117015717487749567724","length":109},"id":"ASB-A-204584366-f6c48b48","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-204584366.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2023-01-01"}]}],"versions":["12"],"ecosystem_specific":{"severity":"High","spl":"2023-01-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"queue"},"deprecated":false,"digest":{"length":1213,"function_hash":"86870526570453178001716111580367832614"},"id":"ASB-A-204584366-364dc1b9"},{"digest":{"function_hash":"182463343494303999816554965884778220659","length":662},"id":"ASB-A-204584366-4b15cf69","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","target":{"function":"queue","file":"core/java/android/hardware/usb/UsbRequest.java"},"deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["302643519188408407467161845134839330253","33816863794465726010140598486210879433","336806779166451494666962633279435806148"]},"id":"ASB-A-204584366-4b837539","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","target":{"file":"core/java/android/hardware/usb/UsbDeviceConnection.java"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"cancelIfOpen"},"deprecated":false,"digest":{"function_hash":"294142877403536958019402403444753907027","length":248},"id":"ASB-A-204584366-a92b8e1c","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","target":{"file":"core/java/android/hardware/usb/UsbRequest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["276104590878752660397844813354367309942","172353618839433354333431412538164318901","95659188306839718572831588354300332447","81174342330019458445585225794288420398","83413780435536255958580647457844443009","293719345425021902667665909660676045871","130247754382031353055193230757160205950","152408938682014877718961330328601492680","162884205329918340703727952116933440069","330292456763100805398861730204970328556","79502387876862938617658865185021275675","284502899353952226313921425102556205516","123811250654480706403060173047200929721","134860343233762423206591019317333971400","6153809002853348190614076489219735788","215798567649815907614467130438533073310","76626048380436355668606965215724175700","139727142540396795720220278206414238800","158028791905717405744513745681220166310","315864079412228123039281842188659089958","258325699040201530618297478399631398911","299046539405841758619786188725324980605","149164128577065074663806298752330135910","134328666961719536294798562605586728543","21266180863328470844807282855264723075","112452450735683852656670016861322480009","121375302352819018791904056330244634324","244952796154726862282007997045077708923","289577562630712681995631442790426893809","218105067570722703058579066673198055589","238066504475044629330268558432848339028","283390287968524347205917300649824936514","304494702597116108711586962432350718927"]},"id":"ASB-A-204584366-ce1d5bed","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"close"},"deprecated":false,"digest":{"function_hash":"7269847508204790583515434263233829328","length":137},"id":"ASB-A-204584366-cf41299c"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"cancel"},"deprecated":false,"digest":{"length":109,"function_hash":"117374267462614018117015717487749567724"},"id":"ASB-A-204584366-eb390c2a","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-204584366.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2023-01-01"}]}],"versions":["12L"],"ecosystem_specific":{"vanir_signatures":[{"target":{"function":"close","file":"core/java/android/hardware/usb/UsbRequest.java"},"deprecated":false,"digest":{"function_hash":"7269847508204790583515434263233829328","length":137},"id":"ASB-A-204584366-000e65ed","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061"},{"target":{"file":"core/java/android/hardware/usb/UsbDeviceConnection.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["302643519188408407467161845134839330253","33816863794465726010140598486210879433","336806779166451494666962633279435806148"]},"id":"ASB-A-204584366-32177294","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"cancel"},"deprecated":false,"digest":{"length":109,"function_hash":"117374267462614018117015717487749567724"},"id":"ASB-A-204584366-490dfeeb","signature_type":"Function","signature_version":"v1"},{"target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"cancelIfOpen"},"deprecated":false,"digest":{"function_hash":"294142877403536958019402403444753907027","length":248},"id":"ASB-A-204584366-a126e721","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","target":{"function":"queue","file":"core/java/android/hardware/usb/UsbRequest.java"},"deprecated":false,"digest":{"function_hash":"182463343494303999816554965884778220659","length":662},"id":"ASB-A-204584366-d164fc3a"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","target":{"file":"core/java/android/hardware/usb/UsbRequest.java"},"deprecated":false,"digest":{"line_hashes":["276104590878752660397844813354367309942","172353618839433354333431412538164318901","95659188306839718572831588354300332447","81174342330019458445585225794288420398","83413780435536255958580647457844443009","293719345425021902667665909660676045871","130247754382031353055193230757160205950","152408938682014877718961330328601492680","162884205329918340703727952116933440069","330292456763100805398861730204970328556","79502387876862938617658865185021275675","284502899353952226313921425102556205516","123811250654480706403060173047200929721","134860343233762423206591019317333971400","6153809002853348190614076489219735788","215798567649815907614467130438533073310","76626048380436355668606965215724175700","139727142540396795720220278206414238800","158028791905717405744513745681220166310","315864079412228123039281842188659089958","258325699040201530618297478399631398911","299046539405841758619786188725324980605","149164128577065074663806298752330135910","134328666961719536294798562605586728543","21266180863328470844807282855264723075","112452450735683852656670016861322480009","121375302352819018791904056330244634324","244952796154726862282007997045077708923","289577562630712681995631442790426893809","218105067570722703058579066673198055589","238066504475044629330268558432848339028","283390287968524347205917300649824936514","304494702597116108711586962432350718927"],"threshold":0.9},"id":"ASB-A-204584366-fc5b6a04"},{"deprecated":false,"digest":{"function_hash":"86870526570453178001716111580367832614","length":1213},"id":"ASB-A-204584366-fe529ce6","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"queue"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061"],"severity":"High","spl":"2023-01-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-204584366.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-01-01"}]}],"versions":["13"],"ecosystem_specific":{"spl":"2023-01-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","target":{"file":"core/java/android/hardware/usb/UsbDeviceConnection.java"},"deprecated":false,"digest":{"line_hashes":["302643519188408407467161845134839330253","33816863794465726010140598486210879433","336806779166451494666962633279435806148"],"threshold":0.9},"id":"ASB-A-204584366-060ec929"},{"deprecated":false,"digest":{"function_hash":"117374267462614018117015717487749567724","length":109},"id":"ASB-A-204584366-499f09d4","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"cancel"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"queue"},"deprecated":false,"digest":{"function_hash":"86870526570453178001716111580367832614","length":1213},"id":"ASB-A-204584366-6b9a33f2","signature_type":"Function","signature_version":"v1"},{"target":{"file":"core/java/android/hardware/usb/UsbRequest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["276104590878752660397844813354367309942","172353618839433354333431412538164318901","95659188306839718572831588354300332447","81174342330019458445585225794288420398","83413780435536255958580647457844443009","293719345425021902667665909660676045871","130247754382031353055193230757160205950","152408938682014877718961330328601492680","162884205329918340703727952116933440069","330292456763100805398861730204970328556","79502387876862938617658865185021275675","284502899353952226313921425102556205516","123811250654480706403060173047200929721","134860343233762423206591019317333971400","6153809002853348190614076489219735788","215798567649815907614467130438533073310","76626048380436355668606965215724175700","139727142540396795720220278206414238800","158028791905717405744513745681220166310","315864079412228123039281842188659089958","258325699040201530618297478399631398911","299046539405841758619786188725324980605","149164128577065074663806298752330135910","134328666961719536294798562605586728543","21266180863328470844807282855264723075","112452450735683852656670016861322480009","121375302352819018791904056330244634324","244952796154726862282007997045077708923","289577562630712681995631442790426893809","218105067570722703058579066673198055589","238066504475044629330268558432848339028","283390287968524347205917300649824936514","304494702597116108711586962432350718927"]},"id":"ASB-A-204584366-7cc03009","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","target":{"function":"close","file":"core/java/android/hardware/usb/UsbRequest.java"},"deprecated":false,"digest":{"function_hash":"7269847508204790583515434263233829328","length":137},"id":"ASB-A-204584366-bbb8789e"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"cancelIfOpen"},"deprecated":false,"digest":{"function_hash":"294142877403536958019402403444753907027","length":248},"id":"ASB-A-204584366-c35ff623","signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061","target":{"file":"core/java/android/hardware/usb/UsbRequest.java","function":"queue"},"deprecated":false,"digest":{"function_hash":"182463343494303999816554965884778220659","length":662},"id":"ASB-A-204584366-ee1d999e","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-204584366.json"}}],"schema_version":"1.9.0"}