CVE-2023-20986: Potential OOB Read in Android Bluetooth Stack
Summary
CVE-2023-20986: In btm_ble_clear_resolving_list_completecomplete of btm_ble_privacy.cc, there is a possible out of bounds read due to a missing bounds check. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2023-06-01
>= 13-next:0, < 13-next:2023-06-01
Fixed in 13-next:2023-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Bluetooth Stack is responsible for managing Bluetooth functionality on Android devices. It provides APIs and protocols for establishing and maintaining Bluetooth connections, as well as handling various Bluetooth-related tasks. The Bluetooth stack is a critical component of the Android operating system, enabling communication with Bluetooth devices such as headphones, speakers, and smartwatches. However, a vulnerability has been identified in the Bluetooth stack that could lead to local information disclosure.
Vulnerability Detail
The vulnerability, identified as CVE-2023-20986, exists in the btm_ble_clear_resolving_list_completecomplete function of the btm_ble_privacy.cc file in the Android Bluetooth Stack. It is caused by a missing bounds check, which can result in an out-of-bounds read. An attacker with system execution privileges could exploit this vulnerability to disclose sensitive information stored in memory. The exploitation does not require user interaction.
How To Fix
Minimum fixed version
13-next:2023-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability at the moment.
Conclusion
The Android Bluetooth Stack is vulnerable to an out-of-bounds read vulnerability in the btm_ble_clear_resolving_list_completecomplete function. This vulnerability could allow an attacker with system execution privileges to disclose sensitive information stored in memory. It is recommended to update the Android Bluetooth Stack to the fixed version to mitigate this vulnerability.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
This vulnerability could allow an attacker to read sensitive information from the Android Bluetooth Stack, potentially leading to the disclosure of user data or other sensitive information.
No, user interaction is not required for an attacker to exploit this vulnerability.
System execution privileges are required to exploit this vulnerability.
The vulnerability was introduced in Android version 13-next and has been fixed in the 13-next release on June 1, 2023.
More information about the fix can be found in the following sources: [source_link_1], [source_link_2].
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
