Out-of-Bounds Read in BleAdvertiserInterfaceImpl::StartAdvertisingSet() of Bluetooth Stack
Summary
CVE-2023-40083: In parse_gap_data of utils.cc, there is a possible out of bounds read due to a missing bounds check. Affects platform/packages/modules/Bluetooth across 3 version ranges.
>= 13:0, < 13:2023-12-01
>= 14:0, < 14:2023-12-01
>= 14-next:0, < 14-next:2023-12-01
Fixed in 14-next:2023-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth package in the Android ecosystem is responsible for managing Bluetooth functionality on Android devices. It provides APIs and services for Bluetooth communication, including advertising and scanning for nearby devices. The vulnerability affects the BleAdvertiserInterfaceImpl::StartAdvertisingSet() function in the Bluetooth stack.
Vulnerability Detail
The vulnerability arises from a missing length check in the BleAdvertiserInterfaceImpl::StartAdvertisingSet() function of the Bluetooth stack. This can result in an out-of-bounds read in the parse_gap_data function of utils.cc. An attacker can exploit this vulnerability to gain access to sensitive information stored in memory. The vulnerability requires local user execution privileges, and no user interaction is necessary for exploitation.
How To Fix
Minimum fixed version
14-next:2023-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the BleAdvertiserInterfaceImpl::StartAdvertisingSet() function in the Bluetooth stack is vulnerable to an out-of-bounds read. It is crucial to update the Bluetooth package to the latest version and apply the provided fixes to mitigate the risk of local information disclosure. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
The vulnerability can lead to local information disclosure, allowing an attacker to access sensitive data stored in memory.
The vulnerability requires local user execution privileges.
No, user interaction is not needed for exploitation of this vulnerability.
The vulnerability affects versions 12, 12L, 13, and 14 of the Bluetooth package in the Android ecosystem.
There are no known instances of this vulnerability being exploited at the moment.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
