CVE-2022-20461: Out of Bounds Read in Bluetooth
Summary
CVE-2022-20461: In pinReplyNative of com_android_bluetooth_btservice_AdapterService.cpp, there is a possible out of bounds read due to type confusion. Affects platform/system/bt across 3 version ranges.
>= 10:0, < 10:2023-01-01
>= 11:0, < 11:2023-01-01
>= 12:0, < 12:2023-01-01
Fixed in 10:2023-01-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Bluetooth package is a module in the Android ecosystem that provides functionality for Bluetooth communication. It allows devices to connect and exchange data wirelessly. This vulnerability affects versions 10 and above of the Android platform. The vulnerability can lead to local escalation of privilege in Bluetooth Low Energy (BLE) without requiring additional execution privileges. Exploitation does not require user interaction.
Vulnerability Detail
The vulnerability exists in the pinReplyNative function of the com_android_bluetooth_btservice_AdapterService.cpp file. It is caused by a type confusion issue, resulting in an out of bounds read. An attacker could exploit this vulnerability to escalate their privileges locally in BLE. This could potentially lead to unauthorized access or control of Bluetooth devices. The vulnerability was introduced in Android version 10 and has been fixed in subsequent versions.
How To Fix
Minimum fixed version
10:2023-01-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability at this time.
Conclusion
The vulnerability in the Bluetooth package allows for local privilege escalation in Bluetooth Low Energy. It is crucial to update the package to the latest version to mitigate the risk of unauthorized access or control of Bluetooth devices. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for platform/system/bt →
FAQ
The vulnerability allows for local privilege escalation in Bluetooth Low Energy, potentially leading to unauthorized access or control of Bluetooth devices.
No, exploitation of this vulnerability does not require user interaction.
Versions 10 and above of the Android platform are affected by this vulnerability.
Yes, this vulnerability has been fixed in Android versions 11 and above.
No, there are no known workarounds for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for platform/system/bt.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
