CVE-2023-20979: Out of Bounds Read in libbt-stack
Summary
CVE-2023-20979: In GetNextSourceDataPacket of bta_av_co.cc, there is a possible out of bounds read due to a missing bounds check. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2023-06-01
>= 13-next:0, < 13-next:2023-06-01
Fixed in 13-next:2023-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is the Bluetooth module in the Android platform. It is responsible for handling Bluetooth functionality on Android devices. This vulnerability affects the libbt-stack library, specifically the functions A2DP_GetPacketTimestampSbc, A2DP_GetPacketTimestampAac, and A2DP_VendorGetPacketTimestamp in the a2dp_aac.cc file. These functions are used for retrieving packet timestamps in the Advanced Audio Distribution Profile (A2DP) protocol. The vulnerability allows for an out of bounds read due to a missing bounds check in the GetNextSourceDataPacket function of the bta_av_co.cc file. This can result in local information disclosure without requiring additional execution privileges. Exploitation does not require user interaction.
Vulnerability Detail
The vulnerability arises from a missing bounds check in the GetNextSourceDataPacket function of the bta_av_co.cc file. This can lead to an out of bounds read, potentially exposing sensitive information. The impact of this vulnerability is local information disclosure, which could be leveraged by an attacker to gather sensitive data without requiring any additional privileges. The vulnerability does not require user interaction for exploitation.
How To Fix
Minimum fixed version
13-next:2023-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The libbt-stack library in the Android Bluetooth module is vulnerable to an out of bounds read, which can result in local information disclosure. The vulnerability can be fixed by updating the affected package to version 13-next:2023-06-01 or later.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
The impact of this vulnerability is local information disclosure, which could be exploited by an attacker to gather sensitive data without requiring any additional privileges.
No, user interaction is not needed for exploitation of this vulnerability.
The affected package is platform/packages/modules/Bluetooth in the Android ecosystem. The vulnerability was introduced in version 13-next and was fixed in version 13-next:2023-06-01.
More information about this vulnerability can be found in the vulnerability database source: https://storage.googleapis.com/android-osv/PUB-A-259939364.json
Yes, a fix is available for this vulnerability. It is recommended to update the affected package to version 13-next:2023-06-01 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
