CVE-2023-20963
Android Framework Privilege Escalation Vulnerability
Description
CVE-2023-20963 is a local privilege escalation vulnerability in the Android Framework's WorkSource component caused by a parcel mismatch. This flaw affects Google Android versions 11, 12, 12L, and 13, allowing an attacker with low-level local access to escalate privileges without any user interaction. Exploitation of CVE-2023-20963 enables full compromise of the affected Android device, including access to sensitive data and system-level control. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild, with a remediation deadline of May 4, 2023. The EPSS score of 2.2% suggests a moderate probability of exploitation attempts, though confirmed in-the-wild activity makes immediate patching essential.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| android | 11.0; 12.0; 12.1; 13.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://source.android.com/security/bulletin/2023-03-01(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20963(Third Party Advisory, US Government Resource)
Weakness Type
CWE-295: Improper Certificate Validation
In the context of CVE-2023-20963, the underlying weakness involves improper validation within the Android Framework's WorkSource parcel handling. A parcel mismatch occurs when serialized and deserialized data structures are inconsistently validated, allowing an attacker to craft input that bypasses security checks and achieves privilege escalation on the device.
Learn more: CWE-295 — Improper Certificate Validation
Impact Analysis
CVE-2023-20963 carries a CVSS v3.1 score of 7.8 (High severity), reflecting the significant damage an attacker can inflict once they gain local access to an Android device. Attack Vector (Local): the vulnerability requires the attacker to have local access to the device, meaning it is not remotely exploitable over the network but can be triggered by a malicious app installed on the device. Attack Complexity (Low): exploitation is straightforward and does not require special conditions or race-condition timing. Privileges Required (Low): the attacker needs only basic low-level privileges, such as those granted to a standard installed application. User Interaction (None): no action by the device owner is needed for exploitation to succeed. Confidentiality, Integrity, and Availability (all High): a successful exploit grants the attacker elevated privileges, potentially allowing full read and write access to sensitive data, modification of system files, and disruption of device availability. Given that this vulnerability has been actively exploited in the wild, the real-world impact includes potential spyware deployment and unauthorized data exfiltration from compromised Android devices.
Exploit Maturity
CVE-2023-20963 has been confirmed as actively exploited in the wild by CISA, which added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 4, 2023. Active Exploitation: this vulnerability has been leveraged by threat actors to deploy malicious payloads on Android devices through trojanized applications. The EPSS score of 2.2% (84th percentile) indicates that while the exploitation probability is not among the highest observed, the confirmed active exploitation makes this a priority for remediation. The ransomware association for CVE-2023-20963 is currently classified as unknown, but the privilege escalation capability makes it a valuable component in multi-stage attack chains targeting Android devices.
Remediation
- Apply the Android security patch immediately. Install the March 2023 Android security bulletin update (patch level 2023-03-01 or later) as specified in the vendor advisory. CISA's required action is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable, with a deadline of May 4, 2023.
- Update all affected Android versions. Ensure devices running Android 11, 12, 12L, and 13 receive the latest security patches through the device manufacturer's update channel or Google Play system updates.
- Restrict application installations. Limit sideloading of APK files from untrusted sources by enforcing Google Play Protect and disabling installation from unknown sources in device settings, as exploitation typically requires a malicious application to be installed on the device.
- Monitor for indicators of compromise. Review installed applications for suspicious behavior, check device logs for unexpected privilege escalation attempts, and use mobile threat detection solutions to identify compromised devices.
- Implement enterprise mobile device management (MDM). Deploy MDM policies to enforce timely security patch installation across managed device fleets and restrict app installations to vetted applications from trusted sources.
Technical Details
CVE-2023-20963 resides in the WorkSource class within the Android Framework, where a parcel mismatch vulnerability allows local privilege escalation. Vulnerability Mechanism: the flaw occurs during the serialization and deserialization (parceling and unparceling) of WorkSource objects, where inconsistent handling of parcel data creates a type confusion condition. When a crafted parcel is processed, the mismatch between the written and read data types allows an attacker to manipulate object references and gain elevated execution context. CVSS Vector Analysis (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): the local attack vector indicates that exploitation occurs through a malicious application running on the device rather than over the network. The low attack complexity and low privileges required mean that any installed application with basic permissions can trigger the vulnerability. The scope remains unchanged, meaning the impact is confined to the Android Framework's privilege boundary, but with high impacts across confidentiality, integrity, and availability, the attacker achieves full control within that boundary. The Android ID A-220302519 tracks this issue internally, and the vulnerability was patched in the March 2023 security bulletin.
Frequently Asked Questions
Is CVE-2023-20963 being actively exploited?
Yes, CVE-2023-20963 is confirmed to be actively exploited in the wild. CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of May 4, 2023. The ransomware usage associated with this CVE is currently classified as unknown.
What products are affected by CVE-2023-20963?
CVE-2023-20963 affects Google Android versions 11, 12, 12L, and 13. The vulnerability is in the Android Framework's WorkSource component, meaning all devices running these Android versions are potentially vulnerable until the March 2023 security patch is applied.
How do I fix CVE-2023-20963?
To remediate CVE-2023-20963, install the Android security update from the March 2023 Android Security Bulletin (patch level 2023-03-01 or later). Ensure automatic security updates are enabled on your device or manually check for updates through your device manufacturer's update channel. See the Remediation section above for additional hardening steps.
How severe is CVE-2023-20963?
CVE-2023-20963 is rated High severity with a CVSS v3.1 score of 7.8. It allows local privilege escalation without user interaction, meaning a malicious app can silently gain elevated privileges. The EPSS score of 2.2% (84th percentile) combined with confirmed active exploitation makes this a high-priority vulnerability for remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.