« Volver al listado

CVE-2023-20990

Estado: ModificadaMedia (4.4)—

En btm_ble_rand_enc_complete de btm_ble.cc, existe una posible lectura fuera de límites debido a la falta de una comprobación de límites. Esto podría provocar la divulgación local de información con privilegios de ejecución del sistema necesarios. No se necesita interacción del usuario para la explotación.Product: AndroidVersions: Android-13Android ID: A-260568354

Traducción automática del texto original de NVD (en inglés).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Google — Android

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-20990",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-20990",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-25T14:50:56.979486Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.4,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 0.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@android.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Android",
          "versions": [
            {
              "status": "affected",
              "version": "Android-13"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-03-24T20:15:11.983",
  "references": [
    {
      "url": "https://source.android.com/security/bulletin/pixel/2023-06-01",
      "source": "security@android.com"
    },
    {
      "url": "https://source.android.com/security/bulletin/pixel/2023-06-01",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In btm_ble_rand_enc_complete of btm_ble.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-260568354"
    }
  ],
  "lastModified": "2026-06-17T05:31:25.417",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "879FFD0C-9B38-4CAA-B057-1086D794D469"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@android.com"
}