CVE-2023-40129: Bluetooth GATT build_read_multi_rsp Underflow OOB Write
Summary
CVE-2023-40129: In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a heap buffer overflow. Affects platform/system/bt across 2 version ranges.
>= 12:0, < 12:2023-10-01
>= 12L:0, < 12L:2023-10-01
Fixed in 12:2023-10-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Bluetooth package in the Android ecosystem is responsible for managing Bluetooth functionality on Android devices. It provides APIs and services for Bluetooth communication, including the Generic Attribute Profile (GATT) protocol. GATT allows devices to exchange data and control information over Bluetooth connections. This vulnerability affects the Bluetooth package in Android versions 12 and 13.
Vulnerability Detail
The vulnerability, identified as CVE-2023-40129, resides in the build_read_multi_rsp function of the gatt_sr.cc file. It is caused by a heap buffer overflow, leading to an out-of-bounds write. An attacker within proximity of the affected device can exploit this vulnerability to execute arbitrary code remotely, without requiring any additional execution privileges or user interaction. The impact of this vulnerability can be severe, as it allows an attacker to take control of the affected device.
How To Fix
Minimum fixed version
12:2023-10-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability. It is essential to apply the fix as soon as possible to mitigate the risk of exploitation.
Conclusion
The Bluetooth GATT build_read_multi_rsp underflow vulnerability (CVE-2023-40129) poses a critical security risk to Android devices running versions 12 and 13. It allows an attacker within proximity to execute arbitrary code remotely, potentially leading to complete compromise of the device. To mitigate this vulnerability, it is crucial to update the Bluetooth package to the fixed version and keep the Android Security Bulletin up to date. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for platform/system/bt →
FAQ
This vulnerability allows an attacker within proximity of the affected device to execute arbitrary code remotely, potentially leading to complete compromise of the device.
No, user interaction is not needed for exploitation. The attacker can exploit this vulnerability remotely without any user interaction.
This vulnerability affects Android versions 12 and 13.
This vulnerability is classified as critical due to its potential for remote code execution and device compromise.
For more information about this vulnerability, you can refer to the Android Security Bulletin (ASB) with the ID ASB-A-273874525.
Related vulnerabilities
Recent vulnerabilities recorded for platform/system/bt.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
