CVE-2022-20222: Out of Bounds Write in read_attr_value Function in Bluetooth
Summary
CVE-2022-20222: In read_attr_value of gatt_db.cc, there is a possible out of bounds write due to a missing bounds check. Affects platform/system/bt across 2 version ranges.
>= 12:0, < 12:2022-07-01
>= 12L:0, < 12L:2022-07-01
Fixed in 12:2022-07-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is platform/system/bt, which is a component of the Android ecosystem. It is responsible for handling Bluetooth functionality on Android devices. Bluetooth is a wireless communication technology used for short-range data exchange between devices. The package provides the necessary infrastructure and protocols for Bluetooth communication. However, a vulnerability has been discovered in the read_attr_value function of the gatt_db.cc file, which could lead to remote code execution.
Vulnerability Detail
The vulnerability, identified as CVE-2022-20222, originates from a missing bounds check in the read_attr_value function of the gatt_db.cc file. This flaw allows an attacker to perform an out-of-bounds write, potentially leading to remote code execution. The vulnerability does not require any additional execution privileges and can be exploited without user interaction. If successfully exploited, an attacker could gain control over the affected device's Bluetooth functionality and potentially execute arbitrary code.
How To Fix
Minimum fixed version
12:2022-07-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
In conclusion, the platform/system/bt package in the Android ecosystem is vulnerable to an out-of-bounds write vulnerability in the read_attr_value function of the gatt_db.cc file. This vulnerability could allow remote code execution without requiring any additional execution privileges or user interaction. It is crucial to update the package to version 12 or a later version to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/system/bt →
FAQ
The vulnerability allows an attacker to perform remote code execution, potentially leading to complete control over the affected device's Bluetooth functionality.
No, user interaction is not needed for exploitation of this vulnerability.
Versions 12 and 12L of the platform/system/bt package are affected by this vulnerability.
Yes, the vulnerability has been fixed in version 12 of the platform/system/bt package, released on July 1, 2022.
The severity of this vulnerability is classified as Critical.
Related vulnerabilities
Recent vulnerabilities recorded for platform/system/bt.
