CVE-2022-20521: NULL Pointer Access in sdpu_find_most_specific_service_uuid Function in Bluetooth
Summary
CVE-2022-20521: In sdpu_find_most_specific_service_uuid of sdp_utils.cc, there is a possible way to crash Bluetooth due to a missing null check. Affects platform/packages/modules/Bluetooth versions >= 13:0, < 13:2022-12-01. Fixed in 13:2022-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Bluetooth package is a module in the Android ecosystem that provides functionality for Bluetooth communication. It allows devices to connect and exchange data wirelessly. The sdpu_find_most_specific_service_uuid function in the sdp_utils.cc file is responsible for finding the most specific service UUID in the Bluetooth stack. This vulnerability affects the Bluetooth package in Android versions 13 and earlier. It can be exploited locally to cause a denial of service (DoS) attack without requiring additional execution privileges.
Vulnerability Detail
The vulnerability exists in the sdpu_find_most_specific_service_uuid function of the Bluetooth package. It is caused by a missing null check, which can lead to a NULL pointer access. An attacker can trigger this vulnerability by interacting with the Bluetooth functionality on a vulnerable device. This can result in a crash of the Bluetooth service, causing a local denial of service. The impact of this vulnerability is limited to disrupting Bluetooth functionality and does not grant the attacker any additional privileges.
How To Fix
Minimum fixed version
13:2022-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The Bluetooth package in Android versions 13 and earlier is vulnerable to a NULL pointer access in the sdpu_find_most_specific_service_uuid function. This can be exploited locally to cause a denial of service attack. However, a fix has been released, and developers should update their Android devices to a version where the fix has been implemented.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
The impact of this vulnerability is limited to causing a local denial of service (DoS) attack. It can crash the Bluetooth service on a vulnerable device, disrupting Bluetooth functionality. However, it does not grant the attacker any additional execution privileges.
Yes, user interaction is required for exploitation. The attacker needs to interact with the Bluetooth functionality on the vulnerable device to trigger the vulnerability.
This vulnerability affects Android versions 13 and earlier.
There are no known instances of this vulnerability being exploited in the wild.
Yes, a fix has been provided in the Bluetooth package. Developers should update their Android devices to a version where the fix has been implemented.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
