CVE-2023-20972: Out-of-Bounds Read in Bluetooth Stack
Summary
CVE-2023-20972: In btm_vendor_specific_evt of btm_devctl.cc, there is a possible out of bounds read due to a missing bounds check. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2023-06-01
>= 13-next:0, < 13-next:2023-06-01
Fixed in 13-next:2023-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth package in the Android ecosystem is responsible for managing Bluetooth functionality on Android devices. It provides APIs and services for Bluetooth communication between devices. This vulnerability affects the Bluetooth stack in Android, specifically the btm_vendor_specific_evt function in the btm_devctl.cc file.
Vulnerability Detail
The btm_vendor_specific_evt function in the Bluetooth stack of Android does not perform a proper bounds check, leading to an out-of-bounds read vulnerability. An attacker can exploit this vulnerability to disclose sensitive information from the device's memory. This vulnerability requires local access to the device and system execution privileges. No user interaction is necessary for exploitation.
How To Fix
Minimum fixed version
13-next:2023-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability at the moment.
Conclusion
The Bluetooth stack in Android is vulnerable to an out-of-bounds read vulnerability in the btm_vendor_specific_evt function. This vulnerability allows local attackers to read sensitive information from the device's memory. It is important for developers to update the Bluetooth package to the fixed version to mitigate this vulnerability.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
This vulnerability allows an attacker with local access to the device to read sensitive information from the device's memory. However, it does not allow remote code execution or privilege escalation.
No, user interaction is not needed for exploitation. The attacker only needs local access to the device.
The vulnerability affects Android versions using the Bluetooth package up to the 13-next release. Versions released after June 1, 2023, have the fix for this vulnerability.
No, there is currently no known workaround for this vulnerability.
The fixed version of the Bluetooth package can be obtained from the official Android source repository. The link to the fixed version is provided in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
