CVE-2023-20964

What it actually does

A confused deputy in multiple MediaSessionRecord.java functions permits unauthorized Intent rebroadcast, enabling local denial of service or privilege escalation without additional privileges or user interaction.

Why it matters to the business

Attackers could disrupt device operations or obtain elevated access, leading to service outages or unauthorized control on affected Android systems; the issue impacts a high-prevalence mobile ecosystem though remediation urgency remains low given stable EPSS and no KEV listing.

How an attack unfolds

An attacker with local access supplies a crafted intent that the confused deputy rebroadcasts, resulting in denial of service or privilege escalation on Android 12 through 13; no named threat actors or ransomware campaigns are associated.

How to fix it

Upgrade affected products to the specified fixed versions; for dhis2/dhis2-core apply commit aec9de0efca6de995e9062719039dd96644b392f. Apply patches and verify intent handling logic across Android-12, Android-12L, and Android-13 builds.

How to confirm the fix worked

Confirm deployment of the fixed commit or patched build, then test intent rebroadcast scenarios in a controlled environment to ensure the confused deputy condition is resolved.

Typical attack path

1. Obtain local access on a vulnerable Android device
2. Identify MediaSessionRecord functions handling intents
3. Craft and deliver malicious intent to trigger rebroadcast
4. Achieve denial of service or privilege escalation without user interaction

How to detect it

Review system logs for anomalous intent rebroadcast events originating from MediaSessionRecord on Android devices; correlate with local process activity to identify potential exploitation attempts.

What your security team should do

• Apply the listed fixed versions immediately on all affected instances
• Audit local intent handling and deputy patterns in custom code
• Monitor EPSS trends and re-evaluate if exploitation maturity increases