CVE-2023-20951: Out-of-Bounds Write in gatt_process_prep_write_rsp Function in Bluetooth Module
Summary
CVE-2023-20951: In gatt_process_prep_write_rsp of gatt_cl.cc, there is a possible out of bounds write due to a missing bounds check. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2023-03-01
>= 13-next:0, < 13-next:2023-03-01
Fixed in 13-next:2023-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth module is a component of the Android operating system that provides support for Bluetooth functionality. It allows devices to communicate wirelessly over short distances, enabling features such as file transfer, audio streaming, and device pairing. The gatt_process_prep_write_rsp function in the gatt_cl.cc file is responsible for processing prepare write responses in the Generic Attribute Profile (GATT) protocol. This vulnerability affects versions 11, 12, 12L, and 13 of the Android Bluetooth module.
Vulnerability Detail
The gatt_process_prep_write_rsp function in gatt_cl.cc lacks proper bounds checking, leading to a potential out-of-bounds write vulnerability. An attacker could exploit this vulnerability remotely without requiring any additional execution privileges or user interaction. By crafting a malicious request, an attacker could trigger the out-of-bounds write, potentially leading to remote code execution. This vulnerability is classified as critical due to its potential for arbitrary code execution.
How To Fix
Minimum fixed version
13-next:2023-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by updating the Android Bluetooth module to the latest version.
Conclusion
The gatt_process_prep_write_rsp function in the Android Bluetooth module is vulnerable to an out-of-bounds write, which could lead to remote code execution. It is crucial to update the module to the latest version (11, 12, 12L, or 13) to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
This vulnerability could allow an attacker to remotely execute arbitrary code on the affected device without requiring any additional privileges or user interaction.
No, user interaction is not needed for exploitation of this vulnerability.
Versions 11, 12, 12L, and 13 of the Android Bluetooth module are affected by this vulnerability.
To fix this vulnerability, you need to update the Android Bluetooth module to the latest version (11, 12, 12L, or 13) and ensure that your application is using the updated module.
No, there is no known workaround for this vulnerability. Updating the Android Bluetooth module is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
