CVE-2022-20224: Crafted HFP Client Packet Causes Out-of-bounds Read in Bluetooth
Summary
CVE-2022-20224: In AT_SKIP_REST of bta_hf_client_at.cc, there is a possible out of bounds read due to an incorrect bounds check. Affects platform/system/bt across 3 version ranges.
>= 10:0, < 10:2022-07-01
>= 11:0, < 11:2022-07-01
>= 12:0, < 12:2022-07-01
Fixed in 10:2022-07-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package under scrutiny is platform/system/bt, which is part of the Android ecosystem. This package is responsible for managing the Bluetooth functionality on Android devices. It provides the necessary components and protocols for Bluetooth communication between devices. The vulnerability affects versions 10, 11, 12, and 12L of the Android operating system. The Bluetooth stack in these versions is susceptible to an out-of-bounds read vulnerability when processing a crafted HFP (Hands-Free Profile) client packet. This vulnerability can be exploited remotely without requiring any additional execution privileges or user interaction.
Vulnerability Detail
The vulnerability arises from an incorrect bounds check in the AT_SKIP_REST function of the bta_hf_client_at.cc file. Due to this flaw, an out-of-bounds read can occur, potentially leading to the disclosure of sensitive information from the Bluetooth stack. An attacker could exploit this vulnerability to obtain Bluetooth-related data without the user's knowledge or consent. The impact of this vulnerability could range from exposing device information to facilitating further attacks on the Bluetooth subsystem.
How To Fix
Minimum fixed version
10:2022-07-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended course of action is to apply the provided fix.
Conclusion
In conclusion, the platform/system/bt package in Android versions 10, 11, 12, and 12L is vulnerable to an out-of-bounds read vulnerability in the Bluetooth stack. This vulnerability can be exploited remotely without user interaction, potentially leading to the disclosure of sensitive information. It is recommended to apply the provided fix to mitigate the risk associated with this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/system/bt →
FAQ
The package affected by this vulnerability is platform/system/bt, which is part of the Android ecosystem.
The vulnerability can lead to the disclosure of sensitive information from the Bluetooth stack, potentially exposing device information and facilitating further attacks on the Bluetooth subsystem.
No, user interaction is not needed for exploitation of this vulnerability.
Versions 10, 11, 12, and 12L of the Android operating system are affected by this vulnerability.
The fix for this vulnerability is available in the commit 7c21b56b7880579965e95cf24c2ab49326a3f2b9.
Related vulnerabilities
Recent vulnerabilities recorded for platform/system/bt.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
