CVE-2023-20983: Out-of-Bounds Read in Bluetooth Stack
Summary
CVE-2023-20983: In btm_ble_rand_enc_complete of btm_ble.cc, there is a possible out of bounds read due to a missing bounds check. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2023-06-01
>= 13-next:0, < 13-next:2023-06-01
Fixed in 13-next:2023-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth package in the Android ecosystem is responsible for handling Bluetooth functionality on Android devices. It provides APIs and services for Bluetooth communication between devices. This package is vulnerable to an out-of-bounds read issue in the btm_ble_rand_enc_complete function of the btm_ble.cc file.
Vulnerability Detail
The btm_ble_rand_enc_complete function in the Bluetooth package of Android's Bluetooth stack lacks proper bounds checking, leading to an out-of-bounds read vulnerability. An attacker could exploit this vulnerability to disclose sensitive information, potentially leading to further attacks. This vulnerability requires system execution privileges, and no user interaction is necessary for exploitation.
How To Fix
Minimum fixed version
13-next:2023-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix provided by updating the Bluetooth package to the latest version.
Conclusion
The Bluetooth package in the Android ecosystem is vulnerable to an out-of-bounds read issue in the btm_ble_rand_enc_complete function. This vulnerability can be mitigated by updating to version 13-next or later.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
This vulnerability could allow an attacker to read sensitive information from the Bluetooth stack, potentially leading to further attacks.
No, user interaction is not needed for exploitation of this vulnerability.
System execution privileges are needed to exploit this vulnerability.
No, only versions up to 13-next are affected. The fix was implemented in version 13-next.
No, there is no known workaround. Updating to the fixed version is recommended.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
