{"id":"ASB-A-258652631","details":"In gatt_process_prep_write_rsp of gatt_cl.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-258652631","CVE-2023-20951"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2023-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-03-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/7ad513b983389b194e419698da278c1c0481f46d"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13-next:0"},{"fixed":"13-next:2023-03-01"}]}],"versions":["13-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/fae5e18313da0d83e860aa48311b5d0892bb8b87"],"severity":"Critical","spl":"2023-03-01","types":["RCE"],"vanir_signatures":[{"target":{"file":"system/stack/gatt/gatt_cl.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["15290592489318013650251690264185527604","256702296040400058131854358176192740640","320450332476430292575405127449542050683","250806685207083960582903055345288041489","58512730648589681388045340449943327845","107249252000611605307661078880728890078","263960294108843561849453014890321491137","193280761510562669588847252023504767888"]},"id":"ASB-A-258652631-b84f1eef","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/fae5e18313da0d83e860aa48311b5d0892bb8b87"},{"id":"ASB-A-258652631-c4d50158","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/fae5e18313da0d83e860aa48311b5d0892bb8b87","target":{"file":"system/stack/gatt/gatt_cl.cc","function":"gatt_process_prep_write_rsp"},"deprecated":false,"digest":{"length":800,"function_hash":"301009738884903707026088294679338425762"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-258652631.json"}},{"package":{"name":"platform/system/bt","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2023-03-01"}]}],"versions":["11"],"ecosystem_specific":{"severity":"Critical","spl":"2023-03-01","types":["RCE"],"vanir_signatures":[{"digest":{"length":804,"function_hash":"138507308733408136034270396089658444948"},"id":"ASB-A-258652631-7e003c80","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/9b17660bfd6f0f41cb9400ce0236d76c83605e03","target":{"file":"stack/gatt/gatt_cl.cc","function":"gatt_process_prep_write_rsp"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["242505939147136790684248678209831935881","243170690324850092941664603533283373202","320450332476430292575405127449542050683","250806685207083960582903055345288041489","58512730648589681388045340449943327845","107249252000611605307661078880728890078","263960294108843561849453014890321491137","193280761510562669588847252023504767888"],"threshold":0.9},"id":"ASB-A-258652631-c645b1a6","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/9b17660bfd6f0f41cb9400ce0236d76c83605e03","target":{"file":"stack/gatt/gatt_cl.cc"}}],"fixes":["https://android.googlesource.com/platform/system/bt/+/9b17660bfd6f0f41cb9400ce0236d76c83605e03"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-258652631.json"}},{"package":{"name":"platform/system/bt","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2023-03-01"}]}],"versions":["12"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/bt/+/9b17660bfd6f0f41cb9400ce0236d76c83605e03"],"severity":"Critical","spl":"2023-03-01","types":["RCE"],"vanir_signatures":[{"id":"ASB-A-258652631-39cb8c89","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/9b17660bfd6f0f41cb9400ce0236d76c83605e03","target":{"file":"stack/gatt/gatt_cl.cc"},"deprecated":false,"digest":{"line_hashes":["242505939147136790684248678209831935881","243170690324850092941664603533283373202","320450332476430292575405127449542050683","250806685207083960582903055345288041489","58512730648589681388045340449943327845","107249252000611605307661078880728890078","263960294108843561849453014890321491137","193280761510562669588847252023504767888"],"threshold":0.9}},{"id":"ASB-A-258652631-bf4f8d42","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/9b17660bfd6f0f41cb9400ce0236d76c83605e03","target":{"file":"stack/gatt/gatt_cl.cc","function":"gatt_process_prep_write_rsp"},"deprecated":false,"digest":{"function_hash":"138507308733408136034270396089658444948","length":804}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-258652631.json"}},{"package":{"name":"platform/system/bt","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2023-03-01"}]}],"versions":["12L"],"ecosystem_specific":{"types":["RCE"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/9b17660bfd6f0f41cb9400ce0236d76c83605e03","target":{"file":"stack/gatt/gatt_cl.cc","function":"gatt_process_prep_write_rsp"},"deprecated":false,"digest":{"function_hash":"138507308733408136034270396089658444948","length":804},"id":"ASB-A-258652631-3430eb53","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["242505939147136790684248678209831935881","243170690324850092941664603533283373202","320450332476430292575405127449542050683","250806685207083960582903055345288041489","58512730648589681388045340449943327845","107249252000611605307661078880728890078","263960294108843561849453014890321491137","193280761510562669588847252023504767888"],"threshold":0.9},"id":"ASB-A-258652631-9060ff43","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/9b17660bfd6f0f41cb9400ce0236d76c83605e03","target":{"file":"stack/gatt/gatt_cl.cc"}}],"fixes":["https://android.googlesource.com/platform/system/bt/+/9b17660bfd6f0f41cb9400ce0236d76c83605e03"],"severity":"Critical","spl":"2023-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-258652631.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-03-01"}]}],"versions":["13"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d4e34d862bb1b00fd06272e34f7160b5794c73ee"],"severity":"Critical","spl":"2023-03-01","types":["RCE"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d4e34d862bb1b00fd06272e34f7160b5794c73ee","target":{"file":"system/stack/gatt/gatt_cl.cc"},"deprecated":false,"digest":{"line_hashes":["15290592489318013650251690264185527604","256702296040400058131854358176192740640","320450332476430292575405127449542050683","250806685207083960582903055345288041489","58512730648589681388045340449943327845","107249252000611605307661078880728890078","263960294108843561849453014890321491137","193280761510562669588847252023504767888"],"threshold":0.9},"id":"ASB-A-258652631-069dcbf6","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"length":800,"function_hash":"301009738884903707026088294679338425762"},"id":"ASB-A-258652631-c3f6027a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d4e34d862bb1b00fd06272e34f7160b5794c73ee","target":{"file":"system/stack/gatt/gatt_cl.cc","function":"gatt_process_prep_write_rsp"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-258652631.json"}}],"schema_version":"1.9.0"}