CVE-2023-20988: Out-of-Bounds Read in Bluetooth Stack
Summary
CVE-2023-20988: In btm_read_rssi_complete of btm_acl.cc, there is a possible out of bounds read due to a missing bounds check. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2023-06-01
>= 13-next:0, < 13-next:2023-06-01
Fixed in 13-next:2023-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth package in the Android ecosystem is responsible for managing Bluetooth functionality on Android devices. It provides APIs and services for Bluetooth communication between devices. This package is vulnerable to an out-of-bounds read issue in the btm_read_rssi_complete function of the btm_acl.cc file.
Vulnerability Detail
The vulnerability occurs due to a missing bounds check in the btm_read_rssi_complete function. An attacker can exploit this issue to read out-of-bounds memory, potentially leading to the disclosure of sensitive information. The vulnerability requires system execution privileges, but does not require user interaction for exploitation.
How To Fix
Minimum fixed version
13-next:2023-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Bluetooth package in the Android ecosystem is vulnerable to an out-of-bounds read issue in the btm_read_rssi_complete function. This vulnerability can be mitigated by updating the package to version 13-next:2023-06-01 or later. It is recommended to apply the fix as soon as possible to prevent potential information disclosure.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
The vulnerability could allow an attacker to read sensitive information from the Bluetooth server, potentially compromising user privacy.
No, user interaction is not needed for exploitation of this vulnerability.
System execution privileges are needed to exploit this vulnerability.
Yes, a fix is available in version 13-next:2023-06-01 or later of the Bluetooth package.
More information about this vulnerability can be found at https://storage.googleapis.com/android-osv/PUB-A-260569232.json
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
