CVE-2023-20991: Out-of-Bounds Read in Bluetooth Stack
Summary
CVE-2023-20991: In btm_ble_process_periodic_adv_sync_lost_evt of ble_scanner_hci_interface.cc , there is a possible out of bounds read due to a missing bounds check. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2023-06-01
>= 13-next:0, < 13-next:2023-06-01
Fixed in 13-next:2023-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Bluetooth package in the Android ecosystem is responsible for managing Bluetooth functionality on Android devices. It provides APIs and services for Bluetooth communication between devices. This vulnerability affects the Bluetooth stack in Android, specifically the btm_ble_process_periodic_adv_sync_lost_evt function in the ble_scanner_hci_interface.cc file. The Bluetooth stack is responsible for handling Bluetooth Low Energy (BLE) scanning and synchronization events.
Vulnerability Detail
The vulnerability (CVE-2023-20991) is an out-of-bounds read issue in the btm_ble_process_periodic_adv_sync_lost_evt function. Due to a missing bounds check, an attacker can trigger an out-of-bounds read, potentially leading to local information disclosure. Exploitation of this vulnerability requires system execution privileges, but does not require user interaction. The impact of this vulnerability can be significant, as it could allow an attacker to access sensitive information stored in memory.
How To Fix
Minimum fixed version
13-next:2023-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the fix provided by updating the Bluetooth package to the fixed version.
Conclusion
The out-of-bounds read vulnerability in the Bluetooth stack of the Android ecosystem could allow an attacker to access sensitive information stored in memory. To mitigate this vulnerability, developers should update the Bluetooth package to the fixed version or any subsequent version that includes the necessary bounds checks. No specific workaround is available, and exploitation of this vulnerability requires system execution privileges.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
This vulnerability could lead to local information disclosure, potentially allowing an attacker to access sensitive data stored in memory.
No, exploitation of this vulnerability does not require user interaction.
System execution privileges are required to exploit this vulnerability.
No specific workaround is mentioned. The recommended approach is to apply the fix by updating the Bluetooth package.
More information about the fix can be found in the provided source link.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
