CVE-2023-20936: High severity Google Android vulnerability

Published Mar 6, 2023

Updated

In btaavrcdiscdone of btaavact.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-226927612

Affected Software

5 affected components

Google Android=11.0

Google Android=12.0

Google Android=12.1

Google Android=13.0

Google Android

Event History

Mar 6, 2023

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Mar 24, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2023-20936?

CVE-2023-20936 is a vulnerability in the bta_av_rc_disc_done function of bta_av_act.cc in Android that could potentially lead to local escalation of privilege.

What is the severity of CVE-2023-20936?

The severity of CVE-2023-20936 is high with a CVSS score of 7.8.

How does CVE-2023-20936 impact Android?

CVE-2023-20936 could lead to local escalation of privilege on Android devices running versions 11.0, 12.0, 12.1, or 13.0.

Is user interaction required for exploitation?

No, user interaction is not needed for exploitation of CVE-2023-20936.

How can CVE-2023-20936 be fixed?

To fix CVE-2023-20936, it is recommended to apply the security patch provided by Google for the affected Android versions.