{"id":"ASB-A-225879503","details":"In avdt_scb_hdl_pkt_no_frag of avdt_scb_act.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-225879503","CVE-2023-20967"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2023-04-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-04-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/89255db501097bbec90e4fcfc48d634deb239cd6"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13-next:0"},{"fixed":"13-next:2023-04-01"}]}],"versions":["13-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bd13f8b0e270a66a9f4838bfbf18ed45b55d307b"],"severity":"High","spl":"2023-04-01","types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["160475823223709694692935484779951965106","154696022645904474574804220537951798288","204881304623978143126292412930803297850","205210406278698109727909667922963939732","83839792174763969568306192841890842040","16244439158494901510989207408203937730","19811031782401604885272520535036699652","220793427994609885101486620497282402566","232790081967356254852996296434654093300","84068644455205983067601858372788622085"],"threshold":0.9},"id":"ASB-A-225879503-1aad69c9","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bd13f8b0e270a66a9f4838bfbf18ed45b55d307b","target":{"file":"system/stack/avdt/avdt_scb_act.cc"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"214469405554194351694222884349443783881","length":1429},"id":"ASB-A-225879503-7d4f0af3","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bd13f8b0e270a66a9f4838bfbf18ed45b55d307b","target":{"file":"system/stack/avdt/avdt_scb_act.cc","function":"avdt_scb_hdl_pkt_no_frag"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-225879503.json"}},{"package":{"name":"platform/system/bt","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2023-04-01"}]}],"versions":["11"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/b0b968e8c6214e20a5dc3617d66567225df0884f","target":{"file":"stack/avdt/avdt_scb_act.cc"},"deprecated":false,"digest":{"line_hashes":["200171766745263312992980904762974602830","316954794712159713057120320471922789549","232625387882193691963459773524952657044","41963193898342179159120788261398276085","183291432774419377986696078871674350801","171493041263083598170599776879023277641","160930699809750016124452950582888238013","306398003595831665912044305884338125640","44178651368883309356649458973179158249","81852721011000179679023530007899788377","60330170763888164783391900406005157483"],"threshold":0.9},"id":"ASB-A-225879503-0e3c85ff","signature_type":"Line"},{"digest":{"function_hash":"78062415392662941064295793988277239489","length":1457},"id":"ASB-A-225879503-2411b4f8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/b0b968e8c6214e20a5dc3617d66567225df0884f","target":{"file":"stack/avdt/avdt_scb_act.cc","function":"avdt_scb_hdl_pkt_no_frag"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/system/bt/+/b0b968e8c6214e20a5dc3617d66567225df0884f"],"severity":"High","spl":"2023-04-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-225879503.json"}},{"package":{"name":"platform/system/bt","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2023-04-01"}]}],"versions":["12"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/system/bt/+/b0b968e8c6214e20a5dc3617d66567225df0884f","target":{"file":"stack/avdt/avdt_scb_act.cc","function":"avdt_scb_hdl_pkt_no_frag"},"deprecated":false,"digest":{"length":1457,"function_hash":"78062415392662941064295793988277239489"},"id":"ASB-A-225879503-352b1ac7","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["200171766745263312992980904762974602830","316954794712159713057120320471922789549","232625387882193691963459773524952657044","41963193898342179159120788261398276085","183291432774419377986696078871674350801","171493041263083598170599776879023277641","160930699809750016124452950582888238013","306398003595831665912044305884338125640","44178651368883309356649458973179158249","81852721011000179679023530007899788377","60330170763888164783391900406005157483"],"threshold":0.9},"id":"ASB-A-225879503-f967d320","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/b0b968e8c6214e20a5dc3617d66567225df0884f","target":{"file":"stack/avdt/avdt_scb_act.cc"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/system/bt/+/b0b968e8c6214e20a5dc3617d66567225df0884f"],"severity":"High","spl":"2023-04-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-225879503.json"}},{"package":{"name":"platform/system/bt","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2023-04-01"}]}],"versions":["12L"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/b0b968e8c6214e20a5dc3617d66567225df0884f","target":{"file":"stack/avdt/avdt_scb_act.cc"},"deprecated":false,"digest":{"line_hashes":["200171766745263312992980904762974602830","316954794712159713057120320471922789549","232625387882193691963459773524952657044","41963193898342179159120788261398276085","183291432774419377986696078871674350801","171493041263083598170599776879023277641","160930699809750016124452950582888238013","306398003595831665912044305884338125640","44178651368883309356649458973179158249","81852721011000179679023530007899788377","60330170763888164783391900406005157483"],"threshold":0.9},"id":"ASB-A-225879503-4cb44b90"},{"digest":{"function_hash":"78062415392662941064295793988277239489","length":1457},"id":"ASB-A-225879503-7ae62638","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/b0b968e8c6214e20a5dc3617d66567225df0884f","target":{"file":"stack/avdt/avdt_scb_act.cc","function":"avdt_scb_hdl_pkt_no_frag"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/system/bt/+/b0b968e8c6214e20a5dc3617d66567225df0884f"],"severity":"High","spl":"2023-04-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-225879503.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-04-01"}]}],"versions":["13"],"ecosystem_specific":{"severity":"High","spl":"2023-04-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"system/stack/avdt/avdt_scb_act.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["160475823223709694692935484779951965106","183141674541678036154862189846573321941","305469826263511488862035716711201009508","92631406025913527248490585187963341743","83839792174763969568306192841890842040","16244439158494901510989207408203937730","19811031782401604885272520535036699652","220793427994609885101486620497282402566","232790081967356254852996296434654093300","84068644455205983067601858372788622085"]},"id":"ASB-A-225879503-8ed83c1a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/89255db501097bbec90e4fcfc48d634deb239cd6"},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/89255db501097bbec90e4fcfc48d634deb239cd6","target":{"file":"system/stack/avdt/avdt_scb_act.cc","function":"avdt_scb_hdl_pkt_no_frag"},"deprecated":false,"digest":{"function_hash":"288179875468148485908322414536151697148","length":1509},"id":"ASB-A-225879503-a6734942","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/89255db501097bbec90e4fcfc48d634deb239cd6"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-225879503.json"}}],"schema_version":"1.9.0"}