CVE-2023-20974: Out-of-Bounds Read in Bluetooth Stack
Summary
CVE-2023-20974: In btm_ble_add_resolving_list_entry_complete of btm_ble_privacy.cc, there is a possible out of bounds read due to a missing bounds check. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2023-06-01
>= 13-next:0, < 13-next:2023-06-01
Fixed in 13-next:2023-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth package in the Android ecosystem is responsible for managing Bluetooth functionality on Android devices. It provides APIs and services for Bluetooth communication, including support for Bluetooth Low Energy (BLE) devices. The package is an integral part of the Android operating system and is used by various applications and system components.
Vulnerability Detail
The vulnerability (CVE-2023-20974) exists in the Bluetooth stack of the Android platform. Specifically, the issue is present in the btm_ble_add_resolving_list_entry_complete function of the btm_ble_privacy.cc file. The function lacks proper bounds checking, leading to an out-of-bounds read. An attacker can exploit this vulnerability to disclose sensitive information stored in memory. Successful exploitation requires local access with system execution privileges, and no user interaction is necessary.
How To Fix
Minimum fixed version
13-next:2023-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, users and developers should ensure that their Android devices are running the latest security patches and updates. Keeping the device's operating system up to date helps mitigate the risk of known vulnerabilities.
Conclusion
The vulnerability (CVE-2023-20974) in the Bluetooth stack of the Android platform allows for an out-of-bounds read, potentially leading to the disclosure of sensitive information. It can be exploited by an attacker with local access and system execution privileges. To mitigate the risk, developers should update their applications with the fixed version of the Bluetooth package, available from the official Android source code repository. Users should ensure their devices are up to date with the latest security patches.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
The vulnerability allows an attacker with local access and system execution privileges to read sensitive information from memory. This could potentially lead to the disclosure of sensitive data, such as encryption keys or user credentials.
No, user interaction is not needed for exploiting this vulnerability. An attacker with local access and system execution privileges can exploit the vulnerability without any user involvement.
The vulnerability affects Android devices running the Bluetooth package version 13-next released before June 1, 2023. Devices with updated versions of the Bluetooth package are not affected.
No, this vulnerability requires local access to the Android device. Remote exploitation is not possible.
Yes, the vulnerability has been fixed in the 13-next release of the Android platform, starting from the version released on June 1, 2023. Developers can update their applications with the fixed version of the Bluetooth package.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
