CVE-2023-21198: Array Index Error in remove_sdp_record in libbtif
Summary
CVE-2023-21198: In remove_sdp_record of btif_sdp_server.cc, there is a possible out of bounds read due to a missing bounds check. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2023-06-01
>= 13-next:0, < 13-next:2023-06-01
Fixed in 13-next:2023-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is platform/packages/modules/Bluetooth in the Android ecosystem. This package provides Bluetooth functionality to Android devices. It includes various modules and components for Bluetooth communication. The vulnerability affects the btif_sdp_server.cc file in the system/btif/src directory. This file is responsible for handling Service Discovery Protocol (SDP) records in the Bluetooth stack. SDP records contain information about available Bluetooth services on a device.
Vulnerability Detail
The vulnerability, identified as CVE-2023-21198, exists in the remove_sdp_record function of btif_sdp_server.cc. It is caused by a missing bounds check, leading to an array index error. An attacker can exploit this vulnerability to trigger an out-of-bounds read, potentially resulting in local information disclosure. The exploitation does not require any additional execution privileges or user interaction.
How To Fix
Minimum fixed version
13-next:2023-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The vulnerability in the remove_sdp_record function of libbtif can lead to local information disclosure. It can be fixed by updating the affected package to the commit b9a94d52c59f55318e7a7d0d5f199e4a633a7782 or a later version. No workaround is available at the moment. The severity of this vulnerability is considered moderate.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
The vulnerability can lead to local information disclosure, potentially exposing sensitive data on the affected device.
No, user interaction is not needed for exploitation.
There are no known instances of this vulnerability being exploited at the time of this report.
The severity of this vulnerability is considered moderate.
Yes, a fix has been implemented in the commit b9a94d52c59f55318e7a7d0d5f199e4a633a7782 of the affected package.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
