CVE-2023-20990: Potential OOB Read in btm_read_local_oob_complete() of Bluetooth
Summary
CVE-2023-20990: In btm_ble_rand_enc_complete of btm_ble.cc, there is a possible out of bounds read due to a missing bounds check. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2023-06-01
>= 13-next:0, < 13-next:2023-06-01
Fixed in 13-next:2023-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth package is a module in the Android ecosystem that handles Bluetooth functionality. It provides APIs and services for Bluetooth communication between devices. This vulnerability affects the Bluetooth package in Android versions 13-next. The package is responsible for managing Bluetooth Low Energy (BLE) connections and encryption.
Vulnerability Detail
The vulnerability, identified as CVE-2023-20990, exists in the btm_ble_rand_enc_complete function of the btm_ble.cc file in the Bluetooth package. It is caused by a missing bounds check, leading to a potential out-of-bounds read. An attacker could exploit this vulnerability to gain access to sensitive local information. The exploitation does not require user interaction but does require system execution privileges. The vulnerability was introduced in Android version 13-next and has been fixed in Android version 13-next as of June 1, 2023.
How To Fix
Minimum fixed version
13-next:2023-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Bluetooth package in Android versions 13-next is vulnerable to a potential out-of-bounds read in the btm_ble_rand_enc_complete function. This vulnerability could allow an attacker to access sensitive local information. It has been fixed in Android version 13-next as of June 1, 2023. It is recommended to update the Bluetooth package to the fixed version to mitigate the risk.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
This vulnerability could allow an attacker to access sensitive local information.
No, user interaction is not required for exploitation.
System execution privileges are required to exploit this vulnerability.
This vulnerability affects Android versions 13-next.
Yes, this vulnerability has been fixed in Android version 13-next as of June 1, 2023.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
