CVE-2022-20469: Bluetooth avrcp/avdtp heap overflow
Summary
CVE-2022-20469: In avct_lcb_msg_asmbl of avct_lcb_act.cc, there is a possible out of bounds write due to a missing bounds check. Affects platform/system/bt across 4 version ranges.
>= 10:0, < 10:2022-12-01
>= 11:0, < 11:2022-12-01
>= 12:0, < 12:2022-12-01
>= 12L:0, < 12L:2022-12-01
Fixed in 10:2022-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth package in the Android ecosystem is responsible for handling Bluetooth functionality on Android devices. It provides support for various Bluetooth profiles and protocols, including avrcp (Audio/Video Remote Control Profile) and avdtp (Audio/Video Distribution Transport Protocol). These protocols allow users to control audio and video playback on remote devices. However, a vulnerability has been discovered in the avct_lcb_msg_asmbl function of the avct_lcb_act.cc file, which can lead to a heap overflow.
Vulnerability Detail
The avct_lcb_msg_asmbl function in the Bluetooth package does not perform proper bounds checking, allowing an attacker to trigger an out-of-bounds write. This vulnerability can be exploited locally over Bluetooth without requiring any additional execution privileges. An attacker could potentially escalate their privileges and gain control over the affected device. Exploitation does not require user interaction.
How To Fix
Minimum fixed version
10:2022-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Bluetooth package in the Android ecosystem is vulnerable to a heap overflow in the avct_lcb_msg_asmbl function. This vulnerability can be exploited locally over Bluetooth without requiring any additional execution privileges. It is recommended to update the Bluetooth package to a fixed version to mitigate the risk of exploitation. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for platform/system/bt →
FAQ
This vulnerability can lead to local privilege escalation over Bluetooth. An attacker could potentially gain control over the affected device without requiring any additional execution privileges.
No, exploitation of this vulnerability does not require user interaction.
Versions 10, 11, 12, 12L, and 13 of the Android ecosystem are affected by this vulnerability.
Yes, a fix for this vulnerability is available in versions 10, 11, 12, 12L, and 13 of the Android ecosystem. It is recommended to update the Bluetooth package to a version that includes the necessary security patches.
You can find more information about this vulnerability in the following source: https://storage.googleapis.com/android-osv/ASB-A-230867224.json
Related vulnerabilities
Recent vulnerabilities recorded for platform/system/bt.
