{"id":"ASB-A-226927612","details":"In bta_av_rc_disc_done of bta_av_act.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-226927612","CVE-2023-20936"],"modified":"2026-09-29T15:47:20.471282637Z","published":"2023-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-03-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e74ee03c331514ac07b806e82077cc8a1d4e34e9"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13-next:0"},{"fixed":"13-next:2023-03-01"}]}],"versions":["13-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e74ee03c331514ac07b806e82077cc8a1d4e34e9"],"severity":"High","spl":"2023-03-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"system/bta/av/bta_av_act.cc"},"deprecated":false,"digest":{"line_hashes":["174740507774141626498297469825591041546","67274052042458865081982972152876052666","126466726827354327855057899359887170964","209177717336835330717869786405419104100","64855870994560653407214698500002782102"],"threshold":0.9},"id":"ASB-A-226927612-6db1680f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e74ee03c331514ac07b806e82077cc8a1d4e34e9"},{"deprecated":false,"digest":{"length":3398,"function_hash":"104665024436351864154360939788235158045"},"id":"ASB-A-226927612-a1ee1636","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e74ee03c331514ac07b806e82077cc8a1d4e34e9","target":{"function":"bta_av_rc_disc_done","file":"system/bta/av/bta_av_act.cc"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-226927612.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-03-01"}]}],"versions":["13"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"id":"ASB-A-226927612-d50e7411","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e74ee03c331514ac07b806e82077cc8a1d4e34e9","target":{"function":"bta_av_rc_disc_done","file":"system/bta/av/bta_av_act.cc"},"deprecated":false,"digest":{"function_hash":"104665024436351864154360939788235158045","length":3398}},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e74ee03c331514ac07b806e82077cc8a1d4e34e9","target":{"file":"system/bta/av/bta_av_act.cc"},"deprecated":false,"digest":{"line_hashes":["174740507774141626498297469825591041546","67274052042458865081982972152876052666","126466726827354327855057899359887170964","209177717336835330717869786405419104100","64855870994560653407214698500002782102"],"threshold":0.9},"id":"ASB-A-226927612-fbfb95f0","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e74ee03c331514ac07b806e82077cc8a1d4e34e9"],"severity":"High","spl":"2023-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-226927612.json"}}],"schema_version":"1.9.0"}