CVE-2023-20952: Medium severity Google Android vulnerability

Published Mar 6, 2023

Updated

In A2DPBuildCodecHeaderSbc of a2dpsbc.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-186803518

Affected Software

5 affected components

Google Android=11.0

Google Android=12.0

Google Android=12.1

Google Android=13.0

Google Android

Event History

Mar 6, 2023

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Mar 24, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2023-20952?

CVE-2023-20952 is a vulnerability in A2DP_BuildCodecHeaderSbc of a2dp_sbc.cc in Android that could result in local information disclosure.

How severe is CVE-2023-20952?

CVE-2023-20952 has a severity rating of high (5.5).

How does CVE-2023-20952 impact Android versions 11.0 and later?

CVE-2023-20952 can lead to local information disclosure on Android versions 11.0 and later.

Are user interactions required for exploitation of CVE-2023-20952?

No, user interaction is not needed for exploitation of CVE-2023-20952.

Where can I find more information about CVE-2023-20952?

You can find more information about CVE-2023-20952 at the following references: [1](https://source.android.com/security/bulletin/2023-03-01), [2](https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bf98f204564cb67268adb21a5c06148d59d90456), [3](https://source.android.com/docs/security/bulletin/2023-03-01).