Keystroke-injection vulnerability in Pixel 4a (5G) Bluetooth
Summary
CVE-2023-45866: In multiple locations, there is a possible way to inject keystrokes due to improper input validation. Affects platform/packages/modules/Bluetooth across 3 version ranges.
>= 13:0, < 13:2023-12-05
>= 14:0, < 14:2023-12-05
>= 14-next:0, < 14-next:2023-12-05
Fixed in 14-next:2023-12-05. How to fix ↓
Also tracked for
- bluez · Debian:11
The same CVE-2023-45866 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth module in the Android platform is responsible for handling Bluetooth communication between devices. It provides functionality for pairing, connecting, and exchanging data over Bluetooth. The vulnerability affects the 'platform/packages/modules/Bluetooth' package in the Android ecosystem. This package is used by all Pixel devices, including the Pixel 4a (5G).
Vulnerability Detail
The vulnerability allows for keystroke-injection into the Pixel 4a (5G) device over unauthenticated Bluetooth connections. It is caused by improper input validation in multiple locations within the Bluetooth module. An attacker in close proximity to the device can exploit this vulnerability to inject keystrokes remotely, without requiring any additional execution privileges. User interaction is not necessary for the exploitation of this vulnerability. The impact of this vulnerability is the potential escalation of privilege on the affected device.
How To Fix
Minimum fixed version
14-next:2023-12-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the provided fixes or update the Android version on the affected device.
Conclusion
The keystroke-injection vulnerability in the Pixel 4a (5G) Bluetooth module allows for remote escalation of privilege without user interaction. It is crucial to update the affected device to the latest Android version and apply the provided fixes to ensure the security of the device. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
The impact of this vulnerability is the potential escalation of privilege on the affected device. An attacker in close proximity can inject keystrokes remotely, leading to unauthorized access or control over the device.
No, user interaction is not needed for the exploitation of this vulnerability. An attacker can remotely inject keystrokes without any additional execution privileges.
All Pixel devices are impacted by this vulnerability, including the Pixel 4a (5G).
To protect your device, it is recommended to update to the latest available Android version and apply the provided fixes for the Bluetooth module.
There are no known instances of this vulnerability being exploited in the wild. However, it is important to apply the necessary fixes to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
