CVE-2024-0016: Bluetooth (BTM) Out of Bounds Read Vulnerability
Summary
CVE-2024-0016: In multiple locations, there is a possible out of bounds read due to a missing bounds check. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2024-01-01
>= 14:0, < 14:2024-01-01
Fixed in 13:2024-01-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth package in the Android ecosystem is responsible for managing Bluetooth functionality on Android devices. It provides APIs and modules for Bluetooth communication, pairing, and device management. The vulnerability affects the 'btm_ble_process_ext_adv_pkt' function within the Bluetooth module, which is responsible for processing extended advertising packets. This function fails to perform proper bounds checking, leading to an out of bounds read vulnerability. This vulnerability can result in the disclosure of paired device information without requiring any additional execution privileges or user interaction.
Vulnerability Detail
The 'btm_ble_process_ext_adv_pkt' function in the Bluetooth module lacks proper bounds checking, allowing an attacker to read beyond the intended memory boundaries. By exploiting this vulnerability, an attacker can access paired device information, potentially compromising user privacy. The vulnerability exists in multiple versions of the Android ecosystem, starting from Android 11 up to Android 14. The severity of this vulnerability is rated as high.
How To Fix
Minimum fixed version
13:2024-01-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can minimize the risk by disabling Bluetooth when not in use or by keeping their devices updated with the latest security patches.
Conclusion
The Bluetooth (BTM) Out of Bounds Read vulnerability in the Android ecosystem poses a significant risk to user privacy by allowing unauthorized access to paired device information. It is crucial for users to update their Android devices to the latest security patch to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
This vulnerability allows an attacker to access paired device information, potentially compromising user privacy.
No, this vulnerability does not require any additional execution privileges or user interaction for exploitation.
This vulnerability affects Android versions 11, 12, 12L, 13, and 14.
Yes, the fix for this vulnerability was included in the Android security patch released on January 1, 2024.
While there are no specific workarounds provided, users can minimize the risk by disabling Bluetooth when not in use and keeping their devices updated with the latest security patches.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
