CVE-2023-20981: Out-of-Bounds Read in Bluetooth Stack
Summary
CVE-2023-20981: In btu_ble_rc_param_req_evt of btu_hcif.cc, there is a possible out of bounds read due to a missing bounds check. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2023-06-01
>= 13-next:0, < 13-next:2023-06-01
Fixed in 13-next:2023-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Bluetooth package in the Android ecosystem is responsible for handling Bluetooth functionality on Android devices. It provides APIs and protocols for communication between devices. This vulnerability affects the Bluetooth stack and specifically impacts the btu_ble_rc_param_req_evt function in the btu_hcif.cc file.
Vulnerability Detail
The btu_ble_rc_param_req_evt function in the Bluetooth stack lacks proper bounds checking, leading to an out-of-bounds read vulnerability. An attacker could exploit this vulnerability to disclose sensitive information stored in memory. This vulnerability requires local system execution privileges and does not require user interaction.
How To Fix
Minimum fixed version
13-next:2023-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability at this time.
Conclusion
The Bluetooth package in the Android ecosystem is vulnerable to an out-of-bounds read vulnerability in the btu_ble_rc_param_req_evt function. This vulnerability allows an attacker with local system execution privileges to read sensitive information from memory. To mitigate this vulnerability, developers should update the Bluetooth package to the fixed version.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
This vulnerability allows an attacker to read sensitive information from memory, potentially leading to the exposure of confidential data.
Exploiting this vulnerability requires local system execution privileges.
No, user interaction is not needed for exploitation of this vulnerability.
No, only versions introduced before 13-next are affected. The fix was implemented in version 13-next.
More information about the fix can be found in the commit [commit_link].
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
