CVE-2022-20207: Bluetooth GATT enable/connect/disconnect/pairing/discover features are exposed to 3rd-party apps without additional permission
Summary
CVE-2022-20207: In TBD of GattDebugUtils.java, there is a possible permission bypass due to accidentally enabling debug_admin . Affects platform/packages/modules/Bluetooth versions >= 12L-next:0, < 12L-next:2022-06-01. Fixed in 12L-next:2022-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth package in the Android ecosystem provides functionality for Bluetooth communication. It includes features such as GATT (Generic Attribute Profile) enablement, connection, disconnection, pairing, and discovery. These features allow apps to interact with Bluetooth devices and exchange data. However, a vulnerability has been identified in the package that exposes these GATT features to third-party apps without requiring additional permission.
Vulnerability Detail
The vulnerability exists in the GattServiceConfig.java file of the Bluetooth package. The static definitions in this file have an insecure default value, which can be exploited to bypass permissions. This vulnerability could lead to local escalation of privilege without the need for additional execution privileges. It is important to note that user interaction is not required for exploitation. The impact of this vulnerability is a potential compromise of the Bluetooth functionality and unauthorized access to Bluetooth devices.
How To Fix
Minimum fixed version
12L-next:2022-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the fix by updating the Bluetooth package to the fixed version.
Conclusion
The Bluetooth package in the Android ecosystem is vulnerable to a permission bypass issue that exposes GATT features to third-party apps. This can lead to unauthorized access to Bluetooth devices and local privilege escalation. To mitigate the vulnerability, it is crucial to update the Bluetooth package to version 12L or later, which includes the necessary security patches.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
The vulnerability allows third-party apps to access Bluetooth GATT features without additional permission, potentially leading to unauthorized access to Bluetooth devices and local privilege escalation.
No, user interaction is not needed for exploitation of this vulnerability.
To fix this vulnerability, update the Bluetooth package to version 12L or later, which includes the necessary security patches.
No, versions prior to 12L are affected. The vulnerability was fixed in version 12L of the Android ecosystem.
No specific workaround is mentioned for this vulnerability. It is recommended to apply the fix by updating the Bluetooth package.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
