CVE-2023-20946: Critical severity Google Android vulnerability
In onStart of BluetoothSwitchPreferenceController.java, there is a possible permission bypass due to a confused deputy. This could lead to remote escalation of privilege in Bluetooth settings with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/packages/apps/Settingsto a version that resolves this vulnerability.Fixed in 11:2023-02-01 - Upgrade
Upgrade
android/platform/packages/apps/Settingsto a version that resolves this vulnerability.Fixed in 12:2023-02-01 - Upgrade
Upgrade
android/platform/packages/apps/Settingsto a version that resolves this vulnerability.Fixed in 12L:2023-02-01 - Upgrade
Upgrade
android/platform/packages/apps/Settingsto a version that resolves this vulnerability.Fixed in 13:2023-02-01
Event History
Frequently Asked Questions
What is the severity of CVE-2023-20946?
CVE-2023-20946 has a critical severity rating due to its potential for remote escalation of privilege.
How do I fix CVE-2023-20946?
To fix CVE-2023-20946, users should update their Android device to the latest security patch available from Google.
What products are affected by CVE-2023-20946?
CVE-2023-20946 affects Android versions 11.0, 12.0, 12.1, and 13.0.
Can CVE-2023-20946 be exploited without user interaction?
Yes, CVE-2023-20946 can be exploited remotely without any user interaction required.
What type of vulnerability is CVE-2023-20946 classified as?
CVE-2023-20946 is classified as a permission bypass vulnerability within the Bluetooth settings.