CVE-2024-56193: Bluetooth Adapter Details Disclosure in Android Packages
Summary
CVE-2024-56193: There is a possible disclosure of Bluetooth adapter details due to a permissions bypass. Affects :unknown: across 6 version ranges.
>= qt:0, < qt:2025-05-05
>= rvc:0, < rvc:2025-05-05
>= rvc-qpr:0, < rvc-qpr:2025-05-05
>= sc:0, < sc:2025-05-05
>= sc-v2:0, < sc-v2:2025-05-05
>= tm:0, < tm:2025-05-05
Fixed in qt:2025-05-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vulnerability affects various Android packages that manage Bluetooth functionalities. These packages are integral to enabling Bluetooth communication, allowing devices to connect and exchange data wirelessly. The vulnerability arises from a permissions bypass, which could expose sensitive information about the Bluetooth adapter without requiring elevated privileges or user interaction.
Vulnerability Detail
There is a possible disclosure of Bluetooth adapter details due to a permissions bypass. This vulnerability could lead to local information disclosure, allowing unauthorized access to sensitive data related to Bluetooth configurations. The issue is particularly concerning as it does not require any additional execution privileges or user interaction for exploitation, making it a high-risk vulnerability for users of affected Android packages.
How To Fix
Minimum fixed version
qt:2025-05-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to update to the patched versions as mentioned above.
Conclusion
In summary, CVE-2024-56193 poses a significant risk to Android applications utilizing Bluetooth functionalities due to a permissions bypass that can lead to unauthorized information disclosure. It is crucial for developers to update their packages to the latest patched versions to mitigate this vulnerability.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2024-56193 is a vulnerability that allows for the potential disclosure of Bluetooth adapter details in various Android packages due to a permissions bypass.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any signup.
The primary risk is local information disclosure, which could expose sensitive Bluetooth adapter details to unauthorized users, potentially leading to further exploitation.
No, user interaction is not needed for exploitation, making this vulnerability particularly dangerous.
You can update your Android packages to the patched versions by modifying your build configuration to include the fixed versions: qt:2025-05-05, rvc:2025-05-05, rvc-qpr:2025-05-05, sc:2025-05-05, sc-v2:2025-05-05, and tm:2025-05-05.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
