CVE-2023-20973: Potential OOB Read in btm_create_conn_cancel_complete() of Bluetooth
Summary
CVE-2023-20973: In btm_create_conn_cancel_complete of btm_sec.cc, there is a possible out of bounds read due to a missing bounds check. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2023-06-01
>= 13-next:0, < 13-next:2023-06-01
Fixed in 13-next:2023-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth package in the Android ecosystem is responsible for handling Bluetooth communication and functionality. It provides APIs and protocols for establishing and managing Bluetooth connections between devices. This vulnerability affects the btm_create_conn_cancel_complete function in the btm_sec.cc file, which is part of the Bluetooth stack. The function is responsible for handling the completion of a connection cancellation request. The vulnerability allows for a potential out-of-bounds read, which could result in local information disclosure. Exploitation of this vulnerability requires system execution privileges and does not require user interaction.
Vulnerability Detail
The vulnerability arises due to a missing bounds check in the btm_create_conn_cancel_complete function. This missing check allows an attacker to read data outside the bounds of a buffer, potentially leading to the disclosure of sensitive information. The impact of this vulnerability is limited to local information disclosure, as it requires system execution privileges. The vulnerability does not require any user interaction for exploitation.
How To Fix
Minimum fixed version
13-next:2023-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround is currently available for this vulnerability. It is recommended to apply the fix by updating to the fixed version of the Bluetooth package.
Conclusion
The btm_create_conn_cancel_complete function in the Bluetooth package is vulnerable to an out-of-bounds read due to a missing bounds check. This vulnerability could lead to local information disclosure, but it requires system execution privileges and does not require user interaction. To mitigate this vulnerability, it is recommended to update the Bluetooth package to the fixed version.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
The impact of this vulnerability is limited to local information disclosure, as it requires system execution privileges. It does not allow for remote code execution or privilege escalation.
No, user interaction is not required for the exploitation of this vulnerability.
The severity of this vulnerability is classified as Moderate.
The recommended mitigation is to update the Bluetooth package to the fixed version, which includes the necessary bounds check to prevent the vulnerability.
No, there is no publicly available exploit for this vulnerability at the time of this report.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
