CVE-2023-20946 Overview
CVE-2023-20946 is a permission bypass vulnerability in the Android operating system. The flaw resides in the onStart method of BluetoothSwitchPreferenceController.java and stems from a confused deputy condition. An attacker can leverage this weakness to achieve privilege escalation within Bluetooth settings without requiring additional execution privileges or user interaction. Google addressed the issue in the February 2023 Android Security Bulletin under Android ID A-244423101. The vulnerability affects Android versions 11, 12, 12L, and 13.
Critical Impact
A confused deputy in BluetoothSwitchPreferenceController allows privilege escalation in Bluetooth settings on Android 11 through 13 without user interaction.
Affected Products
- Google Android 11
- Google Android 12 and 12L
- Google Android 13
Discovery Timeline
- 2023-02-01 - Google publishes fix in the Android Security Bulletin for February 2023
- 2023-02-28 - CVE-2023-20946 published to NVD
- 2025-03-21 - Last updated in NVD database
Technical Details for CVE-2023-20946
Vulnerability Analysis
The vulnerability exists in BluetoothSwitchPreferenceController.java, a component of the Android Settings application that manages the Bluetooth toggle preference. The onStart lifecycle method performs operations that trust caller-supplied input without validating whether the requesting context holds the appropriate Bluetooth permissions. This represents a confused deputy condition, where a privileged component performs actions on behalf of a less privileged caller.
Because the Settings process runs with elevated platform privileges, any operation it executes inherits those privileges. The defect allows an unprivileged app to influence Bluetooth state changes that should require permissions such as BLUETOOTH_PRIVILEGED or BLUETOOTH_CONNECT. The result is remote escalation of privilege in Bluetooth settings.
Root Cause
The root cause is missing permission enforcement inside a privileged Settings preference controller. The onStart handler in BluetoothSwitchPreferenceController acts as a deputy for whatever component triggers it. Because the controller does not validate the caller's identity or permission state before performing Bluetooth-related actions, an unprivileged caller inherits the Settings process's authority. This pattern aligns with [CWE-441] confused deputy weaknesses.
Attack Vector
An attacker delivers a crafted intent or interaction that causes the Settings UI to invoke the vulnerable preference controller. No user interaction is required, and no additional execution privileges are needed beyond standard application installation. Once onStart executes, the attacker can manipulate Bluetooth settings state in a way that should be restricted to privileged callers. Google has not published exploitation code or proof-of-concept details for this issue. Refer to the Android Security Bulletin February 2023 for advisory details.
Detection Methods for CVE-2023-20946
Indicators of Compromise
- Unexpected Bluetooth state transitions on Android devices running versions 11, 12, 12L, or 13 that have not received the 2023-02-01 security patch level.
- Application logs showing unprivileged packages invoking Bluetooth settings activities or sending intents targeting com.android.settings Bluetooth preference components.
- Devices reporting a security patch level earlier than 2023-02-01 while running affected Android major versions.
Detection Strategies
- Inventory the Android fleet and flag devices with a security patch level prior to 2023-02-01 on Android 11 through 13.
- Monitor mobile threat defense telemetry for applications that programmatically toggle Bluetooth without holding BLUETOOTH_CONNECT or BLUETOOTH_PRIVILEGED permissions.
- Review application install sources and sideloaded APKs for unexpected access to Bluetooth-related intents and Settings activities.
Monitoring Recommendations
- Forward Android device patch level and build fingerprint telemetry to a central log store for continuous compliance verification.
- Alert on Bluetooth radio state changes that occur without corresponding user-initiated UI events.
- Track installation of applications requesting Bluetooth permissions outside of managed enterprise app catalogs.
How to Mitigate CVE-2023-20946
Immediate Actions Required
- Apply the Android security patch level 2023-02-01 or later on all affected devices running Android 11, 12, 12L, or 13.
- Identify devices that have reached end-of-life for vendor updates and plan migration to a supported Android release.
- Restrict installation of untrusted applications through enterprise mobility management policies until patches are deployed.
Patch Information
Google released the fix as part of the February 2023 Android Security Bulletin. Devices must report a security patch level of 2023-02-01 or later to be considered remediated. OEMs distribute the patch through their standard over-the-air update channels. Confirm patch availability and timing with each device manufacturer, as rollout schedules vary.
Workarounds
- Disable Bluetooth on affected devices when the radio is not actively required.
- Use mobile device management to prevent installation of applications from unknown sources on unpatched devices.
- Limit deployment of unmanaged Android devices in environments where Bluetooth-based privilege escalation poses operational risk.
# Verify the Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# A result of 2023-02-01 or later indicates the fix is present
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
