Out-of-Bounds Read in BleAdvertiserInterfaceImpl::SetPeriodicAdvertisingData() of Bluetooth Stack
Summary
CVE-2023-45781: In parse_gap_data of utils.cc, there is a possible out of bounds read due to a missing bounds check. Affects platform/packages/modules/Bluetooth across 3 version ranges.
>= 13:0, < 13:2023-12-01
>= 14:0, < 14:2023-12-01
>= 14-next:0, < 14-next:2023-12-01
Fixed in 14-next:2023-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth package in the Android ecosystem is responsible for managing Bluetooth functionality on Android devices. It provides APIs and services for Bluetooth communication, including advertising and data transfer. The vulnerability affects the BleAdvertiserInterfaceImpl::SetPeriodicAdvertisingData() function in the Bluetooth stack.
Vulnerability Detail
The vulnerability arises from a missing bounds check in the parse_gap_data function of utils.cc. This flaw can lead to an out-of-bounds read, potentially resulting in local information disclosure. Exploitation of this vulnerability requires user execution privileges, but does not necessitate user interaction.
How To Fix
Minimum fixed version
14-next:2023-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The vulnerability in the BleAdvertiserInterfaceImpl::SetPeriodicAdvertisingData() function of the Bluetooth stack can lead to local information disclosure. It is recommended to update the Bluetooth package to a version that includes the necessary fixes. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
This vulnerability can potentially lead to local information disclosure, but it requires user execution privileges to exploit.
No, user interaction is not needed for exploitation of this vulnerability.
The vulnerability affects versions 12, 12L, 13, and 14 of the Bluetooth package in the Android ecosystem.
Updating the Bluetooth package to a version that includes the fixes is the recommended mitigation for this vulnerability.
More information about this vulnerability can be found in the https://storage.googleapis.com/android-osv/ASB-A-275553827.json.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
