{"id":"ASB-A-244423101","details":"In onStart of BluetoothSwitchPreferenceController.java, there is a possible permission bypass due to a confused deputy. This could lead to remote escalation of privilege in Bluetooth settings with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-244423101","CVE-2023-20946"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2023-02-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-02-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Settings/+/9d2b2ca5d86be94e94f70c124a80b4db9d7a3fd0"}],"affected":[{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2023-02-01"}]}],"versions":["11"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/3cc8db3c58355d16956fdfbd6b2c7b030610f22f"],"severity":"High","spl":"2023-02-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/3cc8db3c58355d16956fdfbd6b2c7b030610f22f","target":{"file":"src/com/android/settings/connecteddevice/BluetoothDashboardFragment.java","function":"onActivityCreated"},"deprecated":false,"digest":{"function_hash":"138408172717720399005558655763545125803","length":304},"id":"ASB-A-244423101-36f9bc8b","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/com/android/settings/bluetooth/BluetoothSwitchPreferenceController.java"},"deprecated":false,"digest":{"line_hashes":["131725831959988992615949472794209487465","154908070120310378930732814843205591535","3735484112261496217320131088959465386","165492591298531419599767775461850476105","132937777261348651852835069151856471057","184118213769788426672050920711229916811","32707618715453424389089869013993625932","168975404747031868627182986266777942623","210329000274274397305027758091921182907","90365250968498219387023834309784250763","76898351523038350935301157678005746762","97428026333971879814295892821308776747"],"threshold":0.9},"id":"ASB-A-244423101-48ab83ac","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/3cc8db3c58355d16956fdfbd6b2c7b030610f22f"},{"target":{"file":"src/com/android/settings/connecteddevice/BluetoothDashboardFragment.java"},"deprecated":false,"digest":{"line_hashes":["252968638597356479528817582747575733537","102379073936580832809672027540023741771","243893183483786004222655025677543662890","257011765788636537184709652682173967172","101832766547206809195958755552155863782","202001993679985396524960184873124584732","50522660011902782084080795394864748678","6741800830642604463155091542609158498","205338521830289906035418972049449094852","144774728091313424467350516115645565092","282645872866265337077341551568528401143","308590161388588271317173991092333125992","336237888826733234811000060829406314950","79627703840093986007373463149170889366","243253031962318774563941161557973731829","153000652855426364788397932625596124896","84041416229149848937067921454503141204","330274446503237543892067509593866626221","55582678362007651393291753892087601008","118597789736520932820114966578462335787","260354832645280889720922893958489868499","319415237021722941502390374639922453361","183980863531000496672241071093692063296","307817317990939673577504120564973202169","15689573682105761334742255252507601623","179720680700273908699504340280163815733"],"threshold":0.9},"id":"ASB-A-244423101-4a9b4607","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/3cc8db3c58355d16956fdfbd6b2c7b030610f22f"},{"target":{"function":"onStop","file":"src/com/android/settings/bluetooth/BluetoothSwitchPreferenceController.java"},"deprecated":false,"digest":{"function_hash":"76171152919013290510411031794951847652","length":94},"id":"ASB-A-244423101-8838e085","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/3cc8db3c58355d16956fdfbd6b2c7b030610f22f"},{"target":{"file":"src/com/android/settings/bluetooth/BluetoothSwitchPreferenceController.java","function":"onStart"},"deprecated":false,"digest":{"function_hash":"250505200074142491927505437655211126685","length":168},"id":"ASB-A-244423101-b4df9434","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/3cc8db3c58355d16956fdfbd6b2c7b030610f22f"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-244423101.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2023-02-01"}]}],"versions":["12"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/c55c060361bc7bae2e2f528e6e123933c7ba103e"],"severity":"High","spl":"2023-02-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"src/com/android/settings/connecteddevice/BluetoothDashboardFragment.java","function":"onActivityCreated"},"deprecated":false,"digest":{"function_hash":"123069456074599096701504075190221313001","length":401},"id":"ASB-A-244423101-33caadf9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/c55c060361bc7bae2e2f528e6e123933c7ba103e"},{"target":{"function":"onStart","file":"src/com/android/settings/bluetooth/BluetoothSwitchPreferenceController.java"},"deprecated":false,"digest":{"function_hash":"250505200074142491927505437655211126685","length":168},"id":"ASB-A-244423101-514c5292","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/c55c060361bc7bae2e2f528e6e123933c7ba103e"},{"digest":{"threshold":0.9,"line_hashes":["252968638597356479528817582747575733537","102379073936580832809672027540023741771","243893183483786004222655025677543662890","257011765788636537184709652682173967172","101832766547206809195958755552155863782","202001993679985396524960184873124584732","50522660011902782084080795394864748678","121743204651097864460930790204208198007","108720716903003497332659259489317123791","144774728091313424467350516115645565092","282645872866265337077341551568528401143","310960407903859100406308757672926449730","1812031911573902072063642339042837611","79627703840093986007373463149170889366","243253031962318774563941161557973731829","153000652855426364788397932625596124896","30252659446675248948895188232355414002","94730952668179073105522901144358223314","267114327912121280209714432493094131695","322341373800250462511846949368244240657","100775331750871751447220510908431139059","338239369729342983395532667588324854184","319415237021722941502390374639922453361","183980863531000496672241071093692063296","307817317990939673577504120564973202169","15689573682105761334742255252507601623","179720680700273908699504340280163815733"]},"id":"ASB-A-244423101-57c61728","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/c55c060361bc7bae2e2f528e6e123933c7ba103e","target":{"file":"src/com/android/settings/connecteddevice/BluetoothDashboardFragment.java"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/c55c060361bc7bae2e2f528e6e123933c7ba103e","target":{"file":"src/com/android/settings/bluetooth/BluetoothSwitchPreferenceController.java","function":"onStop"},"deprecated":false,"digest":{"length":94,"function_hash":"76171152919013290510411031794951847652"},"id":"ASB-A-244423101-727ea73d","signature_type":"Function"},{"id":"ASB-A-244423101-754b1b28","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/c55c060361bc7bae2e2f528e6e123933c7ba103e","target":{"file":"src/com/android/settings/bluetooth/BluetoothSwitchPreferenceController.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["131725831959988992615949472794209487465","154908070120310378930732814843205591535","3735484112261496217320131088959465386","165492591298531419599767775461850476105","132937777261348651852835069151856471057","184118213769788426672050920711229916811","32707618715453424389089869013993625932","168975404747031868627182986266777942623","210329000274274397305027758091921182907","90365250968498219387023834309784250763","76898351523038350935301157678005746762","97428026333971879814295892821308776747"]}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-244423101.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2023-02-01"}]}],"versions":["12L"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["131725831959988992615949472794209487465","154908070120310378930732814843205591535","3735484112261496217320131088959465386","165492591298531419599767775461850476105","132937777261348651852835069151856471057","184118213769788426672050920711229916811","32707618715453424389089869013993625932","168975404747031868627182986266777942623","210329000274274397305027758091921182907","90365250968498219387023834309784250763","76898351523038350935301157678005746762","97428026333971879814295892821308776747"],"threshold":0.9},"id":"ASB-A-244423101-1b3842b0","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/e644704beeb809bf5c8d629d4dc76aa8f6d16f3b","target":{"file":"src/com/android/settings/bluetooth/BluetoothSwitchPreferenceController.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/e644704beeb809bf5c8d629d4dc76aa8f6d16f3b","target":{"file":"src/com/android/settings/connecteddevice/BluetoothDashboardFragment.java"},"deprecated":false,"digest":{"line_hashes":["252968638597356479528817582747575733537","102379073936580832809672027540023741771","243893183483786004222655025677543662890","257011765788636537184709652682173967172","101832766547206809195958755552155863782","202001993679985396524960184873124584732","50522660011902782084080795394864748678","121743204651097864460930790204208198007","108720716903003497332659259489317123791","144774728091313424467350516115645565092","282645872866265337077341551568528401143","310960407903859100406308757672926449730","1812031911573902072063642339042837611","79627703840093986007373463149170889366","243253031962318774563941161557973731829","153000652855426364788397932625596124896","30252659446675248948895188232355414002","94730952668179073105522901144358223314","267114327912121280209714432493094131695","322341373800250462511846949368244240657","100775331750871751447220510908431139059","338239369729342983395532667588324854184","319415237021722941502390374639922453361","183980863531000496672241071093692063296","307817317990939673577504120564973202169","15689573682105761334742255252507601623","179720680700273908699504340280163815733"],"threshold":0.9},"id":"ASB-A-244423101-2881a9b8"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/e644704beeb809bf5c8d629d4dc76aa8f6d16f3b","target":{"function":"onActivityCreated","file":"src/com/android/settings/connecteddevice/BluetoothDashboardFragment.java"},"deprecated":false,"digest":{"length":401,"function_hash":"123069456074599096701504075190221313001"},"id":"ASB-A-244423101-7d99a2ee"},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/e644704beeb809bf5c8d629d4dc76aa8f6d16f3b","target":{"function":"onStop","file":"src/com/android/settings/bluetooth/BluetoothSwitchPreferenceController.java"},"deprecated":false,"digest":{"function_hash":"76171152919013290510411031794951847652","length":94},"id":"ASB-A-244423101-a5ed51e0","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"length":168,"function_hash":"250505200074142491927505437655211126685"},"id":"ASB-A-244423101-e2e1607f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/e644704beeb809bf5c8d629d4dc76aa8f6d16f3b","target":{"function":"onStart","file":"src/com/android/settings/bluetooth/BluetoothSwitchPreferenceController.java"}}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/e644704beeb809bf5c8d629d4dc76aa8f6d16f3b"],"severity":"High","spl":"2023-02-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-244423101.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-02-01"}]}],"versions":["13"],"ecosystem_specific":{"spl":"2023-02-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/cdbbd7bba4171033b864487f3da2fa26c843f029","target":{"file":"src/com/android/settings/bluetooth/BluetoothSwitchPreferenceController.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["131725831959988992615949472794209487465","154908070120310378930732814843205591535","3735484112261496217320131088959465386","165492591298531419599767775461850476105","132937777261348651852835069151856471057","184118213769788426672050920711229916811","32707618715453424389089869013993625932","168975404747031868627182986266777942623","210329000274274397305027758091921182907","90365250968498219387023834309784250763","76898351523038350935301157678005746762","97428026333971879814295892821308776747"]},"id":"ASB-A-244423101-0beec4ee","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/cdbbd7bba4171033b864487f3da2fa26c843f029","target":{"file":"src/com/android/settings/connecteddevice/BluetoothDashboardFragment.java"},"deprecated":false,"digest":{"line_hashes":["252968638597356479528817582747575733537","102379073936580832809672027540023741771","243893183483786004222655025677543662890","257011765788636537184709652682173967172","101832766547206809195958755552155863782","202001993679985396524960184873124584732","50522660011902782084080795394864748678","121743204651097864460930790204208198007","108720716903003497332659259489317123791","144774728091313424467350516115645565092","282645872866265337077341551568528401143","310960407903859100406308757672926449730","1812031911573902072063642339042837611","79627703840093986007373463149170889366","243253031962318774563941161557973731829","153000652855426364788397932625596124896","30252659446675248948895188232355414002","94730952668179073105522901144358223314","267114327912121280209714432493094131695","322341373800250462511846949368244240657","100775331750871751447220510908431139059","338239369729342983395532667588324854184","319415237021722941502390374639922453361","183980863531000496672241071093692063296","307817317990939673577504120564973202169","15689573682105761334742255252507601623","179720680700273908699504340280163815733"],"threshold":0.9},"id":"ASB-A-244423101-4b40ada5","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/cdbbd7bba4171033b864487f3da2fa26c843f029","target":{"function":"onStop","file":"src/com/android/settings/bluetooth/BluetoothSwitchPreferenceController.java"},"deprecated":false,"digest":{"length":94,"function_hash":"76171152919013290510411031794951847652"},"id":"ASB-A-244423101-76f4c376","signature_type":"Function"},{"digest":{"length":168,"function_hash":"250505200074142491927505437655211126685"},"id":"ASB-A-244423101-9f74dd9f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/cdbbd7bba4171033b864487f3da2fa26c843f029","target":{"function":"onStart","file":"src/com/android/settings/bluetooth/BluetoothSwitchPreferenceController.java"},"deprecated":false},{"deprecated":false,"digest":{"length":401,"function_hash":"123069456074599096701504075190221313001"},"id":"ASB-A-244423101-b43d40bd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/cdbbd7bba4171033b864487f3da2fa26c843f029","target":{"file":"src/com/android/settings/connecteddevice/BluetoothDashboardFragment.java","function":"onActivityCreated"}}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/cdbbd7bba4171033b864487f3da2fa26c843f029"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-244423101.json"}}],"schema_version":"1.9.0"}