CVE-2022-20221: Crafted AVRCP cmd packet Causes Out-of-bounds Read in Bluetooth
Summary
CVE-2022-20221: In avrc_ctrl_pars_vendor_cmd of avrc_pars_ct.cc, there is a possible out of bounds read due to improper input validation. Affects platform/system/bt across 4 version ranges.
>= 10:0, < 10:2022-07-01
>= 11:0, < 11:2022-07-01
>= 12:0, < 12:2022-07-01
>= 12L:0, < 12L:2022-07-01
Fixed in 10:2022-07-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is platform/system/bt, which is a component of the Android ecosystem. It is responsible for handling Bluetooth functionality on Android devices. Bluetooth is a wireless communication technology that allows devices to exchange data over short distances. The platform/system/bt package provides the necessary software and drivers to enable Bluetooth functionality on Android devices. This package is vulnerable to a specific issue that can be triggered by a crafted AVRCP (Audio/Video Remote Control Profile) command packet.
Vulnerability Detail
The vulnerability, identified as CVE-2022-20221, exists in the avrc_ctrl_pars_vendor_cmd function of the avrc_pars_ct.cc file. It is caused by improper input validation, which can result in an out-of-bounds read. An attacker can exploit this vulnerability remotely over Bluetooth without requiring any additional execution privileges. The vulnerability can lead to the disclosure of sensitive information. It is important to note that user interaction is not necessary for exploitation.
How To Fix
Minimum fixed version
10:2022-07-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to follow the fix provided above and update the package to a secure version.
Conclusion
In conclusion, the platform/system/bt package in the Android ecosystem is vulnerable to a crafted AVRCP cmd packet causing an out-of-bounds read. This vulnerability can be exploited remotely over Bluetooth, leading to the disclosure of sensitive information. It is crucial to update the package to a secure version that includes the necessary security patches. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/system/bt →
FAQ
This vulnerability can lead to remote information disclosure over Bluetooth. An attacker can exploit the vulnerability to access sensitive information without requiring any additional execution privileges.
No, user interaction is not needed for exploitation. The vulnerability can be exploited remotely over Bluetooth.
The vulnerability was introduced in version 10 of the package and affects all subsequent versions up to and including version 12L.
There are no known instances of this vulnerability being exploited at the time of this report.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the gradle.lockfile, without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for platform/system/bt.
