CVE-2023-35666: Bluetooth invalid pointer free in Android Bluetooth Module
Summary
CVE-2023-35666: In bta_av_rc_msg of bta_av_act.cc, there is a possible use after free due to a logic error in the code. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2023-09-01
>= 13-next:0, < 13-next:2023-09-01
Fixed in 13-next:2023-09-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Bluetooth module is responsible for managing Bluetooth functionality on Android devices. It provides APIs and services for Bluetooth communication, including pairing, connecting, and data transfer. The module is an integral part of the Android operating system and is used by various applications and system components. However, a vulnerability has been identified in the module that could potentially lead to local privilege escalation.
Vulnerability Detail
The vulnerability, identified as CVE-2023-35666, exists in the bta_av_rc_msg function of the bta_av_act.cc file in the Android Bluetooth module. The issue arises from a logic error in the code, resulting in a use-after-free vulnerability. An attacker could exploit this vulnerability to escalate their privileges on a local device without requiring any additional execution privileges. Notably, user interaction is not necessary for the successful exploitation of this vulnerability.
How To Fix
Minimum fixed version
13-next:2023-09-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been mentioned for this vulnerability.
Conclusion
The Bluetooth invalid pointer free vulnerability in the Android Bluetooth module poses a significant risk of local privilege escalation. It is crucial to apply the provided patch from the Android Open Source Project to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
The vulnerability allows an attacker to escalate their privileges on a local Android device. This could potentially lead to unauthorized access to sensitive information or the ability to perform malicious actions.
No, user interaction is not needed for the successful exploitation of this vulnerability.
The vulnerability affects Android versions 11, 12, 12L, and 13.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application or device is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, providing valuable insights without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
