CVE-2023-20992: Potential OOB Read in on_iso_link_quality_read() of btm_iso_impl.h
Summary
CVE-2023-20992: In on_iso_link_quality_read of btm_iso_impl.h, there is a possible out of bounds read due to a missing bounds check. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2023-06-01
>= 13-next:0, < 13-next:2023-06-01
Fixed in 13-next:2023-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth package in the Android ecosystem is responsible for handling Bluetooth functionality on Android devices. It provides APIs and services for Bluetooth communication between devices. This vulnerability affects the on_iso_link_quality_read function in the btm_iso_impl.h file. The function is responsible for reading the link quality of an ISO connection. ISO connections are used for high-quality audio streaming and other data transfers over Bluetooth. The vulnerability allows for an out-of-bounds read, which can lead to local information disclosure in the Bluetooth server. This vulnerability requires system execution privileges to exploit and does not require user interaction.
Vulnerability Detail
The on_iso_link_quality_read function in the btm_iso_impl.h file lacks proper bounds checking, leading to a potential out-of-bounds read. An attacker with system execution privileges can exploit this vulnerability to disclose sensitive information stored in the Bluetooth server. This information could include data exchanged over ISO connections, potentially compromising user privacy. The vulnerability has a moderate severity rating and affects Android versions up to 13-next. The vulnerability was fixed in the Android Bluetooth package on June 1, 2023.
How To Fix
Minimum fixed version
13-next:2023-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that their Android devices are updated with the latest security patches and updates. Regularly checking for system updates and applying them promptly can help protect against known vulnerabilities.
Conclusion
The on_iso_link_quality_read function in the btm_iso_impl.h file of the Android Bluetooth package is vulnerable to an out-of-bounds read. This vulnerability can be exploited by an attacker with system execution privileges to disclose sensitive information stored in the Bluetooth server. It is recommended for developers to update their Android Bluetooth package to the fixed version to mitigate this vulnerability. Users should also ensure their Android devices are up to date with the latest security patches.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
This vulnerability can lead to local information disclosure in the Bluetooth server, potentially exposing sensitive data exchanged over ISO connections.
No, this vulnerability does not require user interaction. An attacker with system execution privileges can exploit it without any user involvement.
This vulnerability affects Android versions up to 13-next.
Developers should update their Android Bluetooth package to the fixed version, which is available in the commit with the SHA-1 hash 6ee00faaec12f0631c490cc1cca5f645c617aff0.
Users can mitigate the risk by ensuring that their Android devices are updated with the latest security patches and updates. Regularly checking for system updates and applying them promptly can help protect against known vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
