cbcvebase.
CVE-2023-20954
published 2023-03-24

CVE-2023-20954: In SDP_AddAttribute of sdp_db.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no…

PriorityP354critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.49%
38.8th percentile
In SDP_AddAttribute of sdp_db.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-261867748

Affected

11 ranges
VendorProductVersion rangeFixed in
googleandroid——
googleandroid——
googleandroid——
googleandroid——
googleandroid——
googleandroid——
platformpackages_modules_bluetooth>= 13-next:0 < 13-next:2023-03-0113-next:2023-03-01
platformpackages_modules_bluetooth>= 13:0 < 13:2023-03-0113:2023-03-01
platformsystem_bt>= 11:0 < 11:2023-03-0111:2023-03-01
platformsystem_bt>= 12:0 < 12:2023-03-0112:2023-03-01
platformsystem_bt>= 12L:0 < 12L:2023-03-0112L:2023-03-01

Detection & IOCsextracted from sources · hover to see the quote

  • →Vulnerability is in SDP_AddAttribute function within sdp_db.cc — monitor for anomalous SDP (Service Discovery Protocol) attribute additions or malformed SDP packets targeting Android Bluetooth stack ↗
  • →No user interaction required and no additional privileges needed — exploit can be delivered entirely remotely over Bluetooth, making unauthenticated/zero-click Bluetooth traffic a key detection surface ↗
  • →Affected Android versions are 11, 12, 12L, and 13 — prioritize detection and patching on unpatched devices running these OS versions ↗
  • ·Rated CRITICAL with RCE impact and no user interaction required, meaning exploitation is entirely remote and zero-click over Bluetooth SDP ↗
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.