CVE DatabaseCVE-2023-20963

Updated 2026-06-17한국어 권고문 →

CVE-2023-209637.8/HIGHCISA KEVCWE-295CWE-295

Android WorkSource Parcel Mismatch Local Privilege Escalation Vulnerability (CVE-2023-20963)

⚡ Jump to Patch

Affected Vendors

google, android

Affected Components

android

Published Date

2023-03-24

CVSS v3.1

7.8

HIGH

EPSS (30d)

1.5%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Android operating system versions 11, 12, 12L, and 13

Impact

Local attackers can escalate privileges to the SYSTEM level without any user interaction or additional execution privileges

Mitigation

Immediately update the system to the March 2023 Android Security Patch Level (2023-03-01) or later

Affected Products & Version Scope

All mobile and embedded devices running Android OS versions 11, 12, 12L, and 13

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Apply the latest system updates provided by your device manufacturer (OEM). This vulnerability was officially patched in the March 2023 security bulletin.

For Android Emulators or developer devices (e.g., Pixel), flash the latest factory image using the following commands:

bash

# Reboot the device into bootloader mode
adb reboot bootloader

# Navigate to the extracted factory image directory and run the flash script
# (Warning: Backup your data before running this script)
./flash-all.sh

2. Temporary Workaround & Hardening Configuration

For legacy devices where official patches are unavailable, minimize the attack surface by disabling ADB and restricting unauthorized app installations:

bash

# Disable USB Debugging (ADB) via shell settings
adb shell settings put global adb_enabled 0

# Restrict installation of applications from unknown sources
adb shell settings put secure install_non_market_apps 0

3. Log Audit & IoC Verification Commands

Verify the device's security patch level and monitor system logs for potential exploitation attempts or serialization anomalies:

bash

# 1. Check the current security patch level (Vulnerable if prior to 2023-03-01)
PATCH_LEVEL=$(adb shell getprop ro.build.version.security_patch)
echo 'Current Security Patch Level:' $PATCH_LEVEL

# 2. Audit system logs (logcat) for Parcel or WorkSource mismatch anomalies
adb logcat -d | grep -E -i 'Parcel|WorkSource|serialization|mismatch'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

SentinelOne Singularity AI EDR

Immediately upgrade Android devices to Security Patch Level '2023-03-01' or later and enforce strict application installation policies.

Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot

Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.

100% MITRE ATT&CK Detection · 1-Click Rollback

See Autonomous Endpoint Protection in Action

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability is a serialization mismatch (Parcel Mismatch) vulnerability within the WorkSource class of the Android operating system. It occurs during the marshalling and unmarshalling process of Binder IPC (Inter-Process Communication). Due to inconsistent data structure parsing between the sending process and the receiving system service, the boundary validation of the WorkSource object is bypassed, leading to memory layout corruption during deserialization.

2. Exploitation Mechanics & Attack Scenario

An attacker leveraging a low-privileged local application can craft a malicious Parcel payload and transmit it via a Binder transaction. When the target system service deserializes this payload into a WorkSource object, the mismatch shifts the Binder buffer read pointer. This misalignment causes the system service to interpret subsequent attacker-controlled data as executable objects or commands within the high-privileged context. This exploit requires zero user interaction and runs silently in the background.

3. Infrastructure & Business Impact

As this vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, it has been actively exploited in the wild. Successful exploitation allows local privilege escalation (LPE), enabling attackers to bypass Android's application sandbox, access sensitive user data (credentials, personal info, financial data), install persistent backdoors, and compromise the entire mobile endpoint infrastructure.

Official Vendor Advisories & References

NVD Original English Description

In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-220302519

https://source.android.com/security/bulletin/2023-03-01

Source: security@android.com · Patch, Vendor Advisory

https://source.android.com/security/bulletin/2023-03-01

Source: af854a3a-2127-422b-91ae-364da2661108 · Patch, Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20963

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Third Party Advisory, US Government Resource

Frequently Asked SecOps Questions (CVE-2023-20963)

FAQ

Q1. How critical is CVE-2023-20963 and is it actively exploited in the wild?

CVE-2023-20963 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 1.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2023-20963?

Primary impacted vendors include google, android across android. Scope summary: All mobile and embedded devices running Android OS versions 11, 12, 12L, and 13

Q3. What temporary mitigations or workarounds exist for CVE-2023-20963 before patching?

[Mitigation] Immediately update the system to the March 2023 Android Security Patch Level (2023-03-01) or later Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION