CVE-2023-20936: Out of Bounds Write in bta_av_rc_disc_done Function in Bluetooth
Summary
CVE-2023-20936: In bta_av_rc_disc_done of bta_av_act.cc, there is a possible out of bounds write due to a missing bounds check. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2023-03-01
>= 13-next:0, < 13-next:2023-03-01
Fixed in 13-next:2023-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth package is a module in the Android ecosystem that provides functionality for Bluetooth communication. It allows devices to connect and exchange data wirelessly. The bta_av_rc_disc_done function in the bta_av_act.cc file is responsible for handling remote control discovery events in the Bluetooth Audio/Video Control (AVRCP) profile. This vulnerability affects versions 11, 12, 12L, and 13 of the Android platform. The vulnerability allows for an out of bounds write due to a missing bounds check in the bta_av_rc_disc_done function.
Vulnerability Detail
The vulnerability in the bta_av_rc_disc_done function can be exploited to perform a local escalation of privilege attack. An attacker can trigger the out of bounds write by sending specially crafted input to the affected function. This could lead to arbitrary code execution or the modification of critical data structures in memory. The vulnerability does not require any additional execution privileges and can be exploited without user interaction.
How To Fix
Minimum fixed version
13-next:2023-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability at this time.
Conclusion
The vulnerability in the bta_av_rc_disc_done function of the Bluetooth package can lead to a local escalation of privilege attack. It is recommended to update the Bluetooth package to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
This vulnerability allows for a local escalation of privilege attack, which could potentially lead to the execution of arbitrary code or the modification of critical data structures in memory.
No, user interaction is not needed for exploitation of this vulnerability.
Versions 11, 12, 12L, and 13 of the Android platform are affected by this vulnerability.
Yes, a fix for this vulnerability has been released in the Bluetooth package version 11, which was released on March 1, 2023.
The fix can be obtained from the official Android source code repository: https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e74ee03c331514ac07b806e82077cc8a1d4e34e9
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
