CVE-2023-21196: Potential OOB Read in btm_ble_batchscan_filter_track_adv_vse_cback() of Bluetooth
Summary
CVE-2023-21196: In btm_ble_batchscan_filter_track_adv_vse_cback of btm_ble_batchscan.cc, there is a possible out of bounds read due to a missing bounds check. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2023-06-01
>= 13-next:0, < 13-next:2023-06-01
Fixed in 13-next:2023-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth package is a module in the Android ecosystem that handles Bluetooth functionality. It allows devices to connect and communicate wirelessly. This vulnerability affects the btm_ble_batchscan_filter_track_adv_vse_cback() function in the Bluetooth server. The function is responsible for tracking advertising data during batch scanning. The vulnerability could lead to an out-of-bounds read, potentially resulting in local information disclosure. Exploitation of this vulnerability requires system execution privileges and does not require user interaction.
Vulnerability Detail
The vulnerability exists due to a missing bounds check in the btm_ble_batchscan_filter_track_adv_vse_cback() function. This allows an attacker to read data outside the bounds of the intended buffer. As a result, sensitive information stored in memory could be exposed. The impact of this vulnerability depends on the nature of the data being read and the privileges of the attacker. To exploit this vulnerability, an attacker would need to have system execution privileges. User interaction is not required for exploitation.
How To Fix
Minimum fixed version
13-next:2023-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The btm_ble_batchscan_filter_track_adv_vse_cback() function in the Bluetooth package is vulnerable to an out-of-bounds read, potentially leading to local information disclosure. To mitigate this vulnerability, it is recommended to update the Bluetooth package to the fixed version.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
The impact of this vulnerability is local information disclosure in the Bluetooth server. However, the severity of the impact depends on the nature of the data being read and the privileges of the attacker.
Exploitation of this vulnerability requires system execution privileges.
No, user interaction is not needed for exploitation of this vulnerability.
To fix this vulnerability, update the Bluetooth package to the fixed version available at the provided link.
No workaround has been provided for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
