CVE-2023-21200: Potential OOB Read in Android Bluetooth Stack
Summary
CVE-2023-21200: In on_remove_iso_data_path of btm_iso_impl.h, there is a possible out of bounds read due to improper input validation. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2023-06-01
>= 13-next:0, < 13-next:2023-06-01
Fixed in 13-next:2023-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Bluetooth Stack is responsible for managing Bluetooth functionality on Android devices. It includes various modules and packages, such as the Bluetooth module in the platform/packages/modules/Bluetooth package. This vulnerability specifically affects the btm_iso_impl.h file in the Bluetooth stack. The Bluetooth stack allows devices to connect and communicate wirelessly, enabling features like file sharing, audio streaming, and device pairing.
Vulnerability Detail
The vulnerability identified as CVE-2023-21200 is a potential out-of-bounds read in the btm_iso_impl.h file of the Android Bluetooth Stack. The issue arises due to improper input validation in the on_remove_iso_data_path function. An attacker could exploit this vulnerability to gain unauthorized access to sensitive information stored in the device's memory. This information disclosure does not require any additional execution privileges or user interaction. The vulnerability was introduced in version 13-next of the Bluetooth package and has been fixed in version 13-next as of June 1, 2023.
How To Fix
Minimum fixed version
13-next:2023-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The potential out-of-bounds read vulnerability in the Android Bluetooth Stack's btm_iso_impl.h file could allow local information disclosure without requiring additional execution privileges or user interaction. It is crucial to update the affected Bluetooth package to the fixed version (13-next:2023-06-01) to mitigate this vulnerability. The fix can be obtained from the official Android source repository.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
The vulnerability allows for local information disclosure, potentially exposing sensitive data stored in the device's memory. However, it does not grant additional execution privileges or require user interaction for exploitation.
No, user interaction is not needed for exploitation. The vulnerability can be exploited without any user input.
The vulnerability was introduced in version 13-next of the Bluetooth package.
Yes, the vulnerability has been fixed in version 13-next as of June 1, 2023.
More information about the fix can be found in the official Android source repository at the following URL: https://android.googlesource.com/platform/packages/modules/Bluetooth/+/1a8a5ece61c63560da589d36ed6597de73a5bb1a.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
