{"id":"ASB-A-226927612","details":"In bta_av_rc_disc_done of bta_av_act.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-226927612","CVE-2023-20936"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2023-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-03-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e74ee03c331514ac07b806e82077cc8a1d4e34e9"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13-next:0"},{"fixed":"13-next:2023-03-01"}]}],"versions":["13-next"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["174740507774141626498297469825591041546","67274052042458865081982972152876052666","126466726827354327855057899359887170964","209177717336835330717869786405419104100","64855870994560653407214698500002782102"],"threshold":0.9},"id":"ASB-A-226927612-6db1680f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e74ee03c331514ac07b806e82077cc8a1d4e34e9","target":{"file":"system/bta/av/bta_av_act.cc"}},{"digest":{"function_hash":"104665024436351864154360939788235158045","length":3398},"id":"ASB-A-226927612-a1ee1636","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e74ee03c331514ac07b806e82077cc8a1d4e34e9","target":{"file":"system/bta/av/bta_av_act.cc","function":"bta_av_rc_disc_done"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e74ee03c331514ac07b806e82077cc8a1d4e34e9"],"severity":"High","spl":"2023-03-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-226927612.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-03-01"}]}],"versions":["13"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"id":"ASB-A-226927612-d50e7411","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e74ee03c331514ac07b806e82077cc8a1d4e34e9","target":{"file":"system/bta/av/bta_av_act.cc","function":"bta_av_rc_disc_done"},"deprecated":false,"digest":{"function_hash":"104665024436351864154360939788235158045","length":3398}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e74ee03c331514ac07b806e82077cc8a1d4e34e9","target":{"file":"system/bta/av/bta_av_act.cc"},"deprecated":false,"digest":{"line_hashes":["174740507774141626498297469825591041546","67274052042458865081982972152876052666","126466726827354327855057899359887170964","209177717336835330717869786405419104100","64855870994560653407214698500002782102"],"threshold":0.9},"id":"ASB-A-226927612-fbfb95f0","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e74ee03c331514ac07b806e82077cc8a1d4e34e9"],"severity":"High","spl":"2023-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-226927612.json"}}],"schema_version":"1.9.0"}