{"id":"ASB-A-204584366", "published":"2023-01-01T00:00:00Z", "modified":"2026-05-01T15:24:27.653932157Z", "aliases":["CVE-2023-20920", "A-204584366"], "details":"In queue of UsbRequest.java, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"10:0"}, {"fixed":"10:2023-01-01"}]}], "versions":["10"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252"], "severity":"High", "spl":"2023-01-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"7269847508204790583515434263233829328", "length":137}, "id":"ASB-A-204584366-0fb3334e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java", "function":"close"}}, {"deprecated":false, "digest":{"line_hashes":["276104590878752660397844813354367309942", "172353618839433354333431412538164318901", "95659188306839718572831588354300332447", "81174342330019458445585225794288420398", "83413780435536255958580647457844443009", "293719345425021902667665909660676045871", "130247754382031353055193230757160205950", "152408938682014877718961330328601492680", "162884205329918340703727952116933440069", "330292456763100805398861730204970328556", "79502387876862938617658865185021275675", "284502899353952226313921425102556205516", "123811250654480706403060173047200929721", "134860343233762423206591019317333971400", "6153809002853348190614076489219735788", "215798567649815907614467130438533073310", "76626048380436355668606965215724175700", "139727142540396795720220278206414238800", "158028791905717405744513745681220166310", "315864079412228123039281842188659089958", "258325699040201530618297478399631398911", "299046539405841758619786188725324980605", "149164128577065074663806298752330135910", "39896417751151018977369607813445909083", "147290932525700798576534658043007295680", "213612540297768027605125040485755842497", "143296497971704935600314405063123807833"], "threshold":0.9}, "id":"ASB-A-204584366-1806415e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java"}}, {"deprecated":false, "digest":{"function_hash":"185997965583041455618509918117696796341", "length":97}, "id":"ASB-A-204584366-442de16b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252", "target":{"file":"core/java/android/hardware/usb/UsbDeviceConnection.java", "function":"close"}}, {"deprecated":false, "digest":{"function_hash":"182463343494303999816554965884778220659", "length":662}, "id":"ASB-A-204584366-60de6a61", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java", "function":"queue"}}, {"deprecated":false, "digest":{"function_hash":"289558269005376821094417639689604636205", "length":227}, "id":"ASB-A-204584366-7b4a02cc", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252", "target":{"file":"core/java/android/hardware/usb/UsbDeviceConnection.java", "function":"open"}}, {"deprecated":false, "digest":{"line_hashes":["225644584700868056746365473993952264490", "225516317010957764561976472294732353750", "227002822758297823208964377151056791644", "38391849955678741051553217843086002921", "281439387168020840234618194339149136273", "57293824981797575096545126602507004703", "76621587704719703869209188865501611282", "108074959398907256904588025506263625319", "320966007503038203040299508750587661126", "307199871166993780345791415484723637514", "103948057965550373630226303080849526667", "233253399359387248716780084594558982699", "189212928265885170423237988826636027541", "8866131415284696403577041526688952594", "23860540723638293489521692781539987863", "249794751009769692010176244246866896178", "130247754382031353055193230757160205950", "38016763904969071085606916886336715130"], "threshold":0.9}, "id":"ASB-A-204584366-c2bb47ac", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252", "target":{"file":"core/java/android/hardware/usb/UsbDeviceConnection.java"}}, {"deprecated":false, "digest":{"function_hash":"86870526570453178001716111580367832614", "length":1213}, "id":"ASB-A-204584366-cb8263f3", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7a8d56b2fe3496f7717ad1afe45d2ef523b7e252", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java", "function":"queue"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"11:0"}, {"fixed":"11:2023-01-01"}]}], "versions":["11"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061"], "severity":"High", "spl":"2023-01-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["302643519188408407467161845134839330253", "33816863794465726010140598486210879433", "336806779166451494666962633279435806148"], "threshold":0.9}, "id":"ASB-A-204584366-10eb0cce", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbDeviceConnection.java"}}, {"deprecated":false, "digest":{"function_hash":"182463343494303999816554965884778220659", "length":662}, "id":"ASB-A-204584366-67ea4dc1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java", "function":"queue"}}, {"deprecated":false, "digest":{"function_hash":"86870526570453178001716111580367832614", "length":1213}, "id":"ASB-A-204584366-6c8090b8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java", "function":"queue"}}, {"deprecated":false, "digest":{"function_hash":"7269847508204790583515434263233829328", "length":137}, "id":"ASB-A-204584366-6eb28f6e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java", "function":"close"}}, {"deprecated":false, "digest":{"line_hashes":["276104590878752660397844813354367309942", "172353618839433354333431412538164318901", "95659188306839718572831588354300332447", "81174342330019458445585225794288420398", "83413780435536255958580647457844443009", "293719345425021902667665909660676045871", "130247754382031353055193230757160205950", "152408938682014877718961330328601492680", "162884205329918340703727952116933440069", "330292456763100805398861730204970328556", "79502387876862938617658865185021275675", "284502899353952226313921425102556205516", "123811250654480706403060173047200929721", "134860343233762423206591019317333971400", "6153809002853348190614076489219735788", "215798567649815907614467130438533073310", "76626048380436355668606965215724175700", "139727142540396795720220278206414238800", "158028791905717405744513745681220166310", "315864079412228123039281842188659089958", "258325699040201530618297478399631398911", "299046539405841758619786188725324980605", "149164128577065074663806298752330135910", "134328666961719536294798562605586728543", "21266180863328470844807282855264723075", "112452450735683852656670016861322480009", "121375302352819018791904056330244634324", "244952796154726862282007997045077708923", "289577562630712681995631442790426893809", "218105067570722703058579066673198055589", "238066504475044629330268558432848339028", "283390287968524347205917300649824936514", "304494702597116108711586962432350718927"], "threshold":0.9}, "id":"ASB-A-204584366-b57651ec", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java"}}, {"deprecated":false, "digest":{"function_hash":"294142877403536958019402403444753907027", "length":248}, "id":"ASB-A-204584366-e0608a58", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java", "function":"cancelIfOpen"}}, {"deprecated":false, "digest":{"function_hash":"117374267462614018117015717487749567724", "length":109}, "id":"ASB-A-204584366-f6c48b48", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java", "function":"cancel"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"12:0"}, {"fixed":"12:2023-01-01"}]}], "versions":["12"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061"], "severity":"High", "spl":"2023-01-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"86870526570453178001716111580367832614", "length":1213}, "id":"ASB-A-204584366-364dc1b9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java", "function":"queue"}}, {"deprecated":false, "digest":{"function_hash":"182463343494303999816554965884778220659", "length":662}, "id":"ASB-A-204584366-4b15cf69", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java", "function":"queue"}}, {"deprecated":false, "digest":{"line_hashes":["302643519188408407467161845134839330253", "33816863794465726010140598486210879433", "336806779166451494666962633279435806148"], "threshold":0.9}, "id":"ASB-A-204584366-4b837539", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbDeviceConnection.java"}}, {"deprecated":false, "digest":{"function_hash":"294142877403536958019402403444753907027", "length":248}, "id":"ASB-A-204584366-a92b8e1c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java", "function":"cancelIfOpen"}}, {"deprecated":false, "digest":{"line_hashes":["276104590878752660397844813354367309942", "172353618839433354333431412538164318901", "95659188306839718572831588354300332447", "81174342330019458445585225794288420398", "83413780435536255958580647457844443009", "293719345425021902667665909660676045871", "130247754382031353055193230757160205950", "152408938682014877718961330328601492680", "162884205329918340703727952116933440069", "330292456763100805398861730204970328556", "79502387876862938617658865185021275675", "284502899353952226313921425102556205516", "123811250654480706403060173047200929721", "134860343233762423206591019317333971400", "6153809002853348190614076489219735788", "215798567649815907614467130438533073310", "76626048380436355668606965215724175700", "139727142540396795720220278206414238800", "158028791905717405744513745681220166310", "315864079412228123039281842188659089958", "258325699040201530618297478399631398911", "299046539405841758619786188725324980605", "149164128577065074663806298752330135910", "134328666961719536294798562605586728543", "21266180863328470844807282855264723075", "112452450735683852656670016861322480009", "121375302352819018791904056330244634324", "244952796154726862282007997045077708923", "289577562630712681995631442790426893809", "218105067570722703058579066673198055589", "238066504475044629330268558432848339028", "283390287968524347205917300649824936514", "304494702597116108711586962432350718927"], "threshold":0.9}, "id":"ASB-A-204584366-ce1d5bed", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java"}}, {"deprecated":false, "digest":{"function_hash":"7269847508204790583515434263233829328", "length":137}, "id":"ASB-A-204584366-cf41299c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java", "function":"close"}}, {"deprecated":false, "digest":{"function_hash":"117374267462614018117015717487749567724", "length":109}, "id":"ASB-A-204584366-eb390c2a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java", "function":"cancel"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"12L:0"}, {"fixed":"12L:2023-01-01"}]}], "versions":["12L"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061"], "severity":"High", "spl":"2023-01-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"7269847508204790583515434263233829328", "length":137}, "id":"ASB-A-204584366-000e65ed", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java", "function":"close"}}, {"deprecated":false, "digest":{"line_hashes":["302643519188408407467161845134839330253", "33816863794465726010140598486210879433", "336806779166451494666962633279435806148"], "threshold":0.9}, "id":"ASB-A-204584366-32177294", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbDeviceConnection.java"}}, {"deprecated":false, "digest":{"function_hash":"117374267462614018117015717487749567724", "length":109}, "id":"ASB-A-204584366-490dfeeb", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java", "function":"cancel"}}, {"deprecated":false, "digest":{"function_hash":"294142877403536958019402403444753907027", "length":248}, "id":"ASB-A-204584366-a126e721", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java", "function":"cancelIfOpen"}}, {"deprecated":false, "digest":{"function_hash":"182463343494303999816554965884778220659", "length":662}, "id":"ASB-A-204584366-d164fc3a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java", "function":"queue"}}, {"deprecated":false, "digest":{"line_hashes":["276104590878752660397844813354367309942", "172353618839433354333431412538164318901", "95659188306839718572831588354300332447", "81174342330019458445585225794288420398", "83413780435536255958580647457844443009", "293719345425021902667665909660676045871", "130247754382031353055193230757160205950", "152408938682014877718961330328601492680", "162884205329918340703727952116933440069", "330292456763100805398861730204970328556", "79502387876862938617658865185021275675", "284502899353952226313921425102556205516", "123811250654480706403060173047200929721", "134860343233762423206591019317333971400", "6153809002853348190614076489219735788", "215798567649815907614467130438533073310", "76626048380436355668606965215724175700", "139727142540396795720220278206414238800", "158028791905717405744513745681220166310", "315864079412228123039281842188659089958", "258325699040201530618297478399631398911", "299046539405841758619786188725324980605", "149164128577065074663806298752330135910", "134328666961719536294798562605586728543", "21266180863328470844807282855264723075", "112452450735683852656670016861322480009", "121375302352819018791904056330244634324", "244952796154726862282007997045077708923", "289577562630712681995631442790426893809", "218105067570722703058579066673198055589", "238066504475044629330268558432848339028", "283390287968524347205917300649824936514", "304494702597116108711586962432350718927"], "threshold":0.9}, "id":"ASB-A-204584366-fc5b6a04", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java"}}, {"deprecated":false, "digest":{"function_hash":"86870526570453178001716111580367832614", "length":1213}, "id":"ASB-A-204584366-fe529ce6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java", "function":"queue"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"13:0"}, {"fixed":"13:2023-01-01"}]}], "versions":["13"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061"], "severity":"High", "spl":"2023-01-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["302643519188408407467161845134839330253", "33816863794465726010140598486210879433", "336806779166451494666962633279435806148"], "threshold":0.9}, "id":"ASB-A-204584366-060ec929", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbDeviceConnection.java"}}, {"deprecated":false, "digest":{"function_hash":"117374267462614018117015717487749567724", "length":109}, "id":"ASB-A-204584366-499f09d4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java", "function":"cancel"}}, {"deprecated":false, "digest":{"function_hash":"86870526570453178001716111580367832614", "length":1213}, "id":"ASB-A-204584366-6b9a33f2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java", "function":"queue"}}, {"deprecated":false, "digest":{"line_hashes":["276104590878752660397844813354367309942", "172353618839433354333431412538164318901", "95659188306839718572831588354300332447", "81174342330019458445585225794288420398", "83413780435536255958580647457844443009", "293719345425021902667665909660676045871", "130247754382031353055193230757160205950", "152408938682014877718961330328601492680", "162884205329918340703727952116933440069", "330292456763100805398861730204970328556", "79502387876862938617658865185021275675", "284502899353952226313921425102556205516", "123811250654480706403060173047200929721", "134860343233762423206591019317333971400", "6153809002853348190614076489219735788", "215798567649815907614467130438533073310", "76626048380436355668606965215724175700", "139727142540396795720220278206414238800", "158028791905717405744513745681220166310", "315864079412228123039281842188659089958", "258325699040201530618297478399631398911", "299046539405841758619786188725324980605", "149164128577065074663806298752330135910", "134328666961719536294798562605586728543", "21266180863328470844807282855264723075", "112452450735683852656670016861322480009", "121375302352819018791904056330244634324", "244952796154726862282007997045077708923", "289577562630712681995631442790426893809", "218105067570722703058579066673198055589", "238066504475044629330268558432848339028", "283390287968524347205917300649824936514", "304494702597116108711586962432350718927"], "threshold":0.9}, "id":"ASB-A-204584366-7cc03009", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java"}}, {"deprecated":false, "digest":{"function_hash":"7269847508204790583515434263233829328", "length":137}, "id":"ASB-A-204584366-bbb8789e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java", "function":"close"}}, {"deprecated":false, "digest":{"function_hash":"294142877403536958019402403444753907027", "length":248}, "id":"ASB-A-204584366-c35ff623", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java", "function":"cancelIfOpen"}}, {"deprecated":false, "digest":{"function_hash":"182463343494303999816554965884778220659", "length":662}, "id":"ASB-A-204584366-ee1d999e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1691b54b1fda4239249a3871d2c17ed1ec753061", "target":{"file":"core/java/android/hardware/usb/UsbRequest.java", "function":"queue"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2023-01-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/d8e918fc9d479388661e74638d950592af16c001"}]}