CVE-2023-20954 Overview
CVE-2023-20954 is an out-of-bounds write vulnerability in the SDP_AddAttribute function within sdp_db.cc, a component of the Android Bluetooth stack. The flaw stems from an incorrect bounds check that allows memory to be written beyond the intended buffer. An attacker can exploit this condition remotely without authentication or user interaction, leading to arbitrary code execution within the affected process. The vulnerability affects multiple Android releases and is tracked internally by Google as A-261867748.
Critical Impact
Remote code execution is possible over the network with no privileges and no user interaction required.
Affected Products
- Google Android 11
- Google Android 12 and 12L
- Google Android 13
Discovery Timeline
- 2023-03-24 - CVE-2023-20954 published to NVD
- 2025-02-25 - Last updated in NVD database
Technical Details for CVE-2023-20954
Vulnerability Analysis
The vulnerability resides in SDP_AddAttribute, a function within the Service Discovery Protocol (SDP) database implementation (sdp_db.cc) of the Android Bluetooth stack. SDP is used by Bluetooth devices to advertise and discover available services. When the function processes attributes, an incorrect bounds check permits a write past the end of the destination buffer, classified as [CWE-787] Out-of-Bounds Write.
The issue is reachable over the network attack surface exposed by the Bluetooth subsystem. Because the affected code runs within a privileged system process, successful exploitation can result in remote code execution without requiring additional privileges or interaction from the device user.
Root Cause
The root cause is improper validation of attribute length or count before writing into a fixed-size buffer in the SDP database. The flawed bounds check fails to account for all input conditions, allowing attacker-controlled data to overwrite adjacent memory.
Attack Vector
An adversary within Bluetooth range, or otherwise able to reach the SDP service over a reachable transport, can send crafted SDP attribute data to trigger the out-of-bounds write. The Android Security Bulletin classifies this as a remote code execution vector against the System component. No user interaction or authentication is required.
No verified public proof-of-concept code is available for this vulnerability. Technical details are described in the Android Security Bulletin March 2023.
Detection Methods for CVE-2023-20954
Indicators of Compromise
- Unexpected crashes, reboots, or tombstone reports involving the Bluetooth system process on Android 11, 12, 12L, or 13 devices.
- Anomalous SDP traffic patterns or oversized SDP attribute records observed on Bluetooth interfaces.
- Newly spawned processes or network connections originating from the Bluetooth daemon following pairing or discovery activity.
Detection Strategies
- Monitor mobile fleet telemetry for Android devices reporting build fingerprints that predate the 2023-03-01 security patch level.
- Inspect logcat and Android crash reports for native crashes referencing sdp_db or SDP_AddAttribute.
- Use mobile threat defense tooling to flag devices with Bluetooth enabled that have not received the March 2023 security update.
Monitoring Recommendations
- Track the ro.build.version.security_patch property across enrolled devices to identify unpatched endpoints.
- Alert on repeated Bluetooth stack crashes in enterprise mobility management (EMM) telemetry.
- Review Bluetooth pairing and discovery events in environments where untrusted devices may be in proximity.
How to Mitigate CVE-2023-20954
Immediate Actions Required
- Apply the Android security patch level 2023-03-01 or later on all affected devices.
- Disable Bluetooth on devices that cannot be patched, particularly in high-risk physical environments.
- Enforce a minimum security patch level policy through mobile device management to block non-compliant devices from corporate resources.
Patch Information
Google addressed CVE-2023-20954 in the March 2023 Android Security Bulletin. Device manufacturers integrate the fix into builds reporting a security patch level of 2023-03-01 or later. Refer to the Android Security Bulletin March 2023 for source code patches and OEM coordination details. Users should install vendor-supplied updates as soon as they become available for their device model.
Workarounds
- Keep Bluetooth disabled when not actively in use, especially in public or untrusted environments.
- Avoid enabling Bluetooth discoverable mode on unpatched devices.
- Retire or isolate end-of-life Android devices that will no longer receive security updates from the manufacturer.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
