{"id":"PUB-A-259062118","details":"In _ufdt_output_property_to_fdt of ufdt_convert.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-259062118","CVE-2023-20994"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2023-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-03-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/system/libufdt/+/cd47b8f445d1f81aea3f21b2a87fe7f8dd6b899b"}],"affected":[{"package":{"name":"platform/system/libufdt","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-03-01"}]}],"versions":["13"],"ecosystem_specific":{"spl":"2023-03-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/system/libufdt/+/cd47b8f445d1f81aea3f21b2a87fe7f8dd6b899b","target":{"file":"ufdt_node.c"},"deprecated":false,"digest":{"line_hashes":["269449001427008958041928122750080392103","112340805860402084626537042260897851464","240693715727817098815200077946399606303","294468273371400869360442669935033790812"],"threshold":0.9},"id":"PUB-A-259062118-2631f546","match_only_versions":["13"],"signature_type":"Line","signature_version":"v1"},{"target":{"file":"ufdt_convert.c"},"deprecated":false,"digest":{"line_hashes":["323823544825511865549810849294439825958","252550072065703209345694713108339039426","256790285941853020554086339324470224161","237655318303759473040719225354304006561","206631571228838832085912481911929194718","9342052278200326340437172155188535543"],"threshold":0.9},"id":"PUB-A-259062118-46b851d3","match_only_versions":["13"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/libufdt/+/cd47b8f445d1f81aea3f21b2a87fe7f8dd6b899b"},{"digest":{"length":849,"function_hash":"56318145640195371400370385402936887310"},"id":"PUB-A-259062118-b167ce39","match_only_versions":["13"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/libufdt/+/cd47b8f445d1f81aea3f21b2a87fe7f8dd6b899b","target":{"function":"_ufdt_output_property_to_fdt","file":"ufdt_convert.c"},"deprecated":false},{"digest":{"length":276,"function_hash":"320014862824155551697134664963469726161"},"id":"PUB-A-259062118-f3d173c2","match_only_versions":["13"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/libufdt/+/cd47b8f445d1f81aea3f21b2a87fe7f8dd6b899b","target":{"function":"ufdt_node_get_fdt_prop_data","file":"ufdt_node.c"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/system/libufdt/+/cd47b8f445d1f81aea3f21b2a87fe7f8dd6b899b"],"severity":"Moderate"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-259062118.json"}}],"schema_version":"1.9.0"}