CVE-2023-20931: Out of Bounds Write in avdt_scb_hdl_write_req in libbt-stack
Summary
CVE-2023-20931: In avdt_scb_hdl_write_req of avdt_scb_act.cc, there is a possible out of bounds write due to a heap buffer overflow. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2023-03-01
>= 13-next:0, < 13-next:2023-03-01
Fixed in 13-next:2023-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is platform/packages/modules/Bluetooth in the Android ecosystem. This package provides Bluetooth functionality for Android devices. It allows users to connect and communicate with Bluetooth devices such as headphones, speakers, and smartwatches. The avdt_scb_hdl_write_req function in the avdt_scb_act.c file of the libbt-stack library is responsible for handling write requests in the AVDTP (Audio/Video Distribution Transport Protocol) service. AVDTP is used for streaming audio and video content over Bluetooth connections. This vulnerability affects versions 11, 12, 12L, and 13 of the Android platform.
Vulnerability Detail
The vulnerability, identified as CVE-2023-20931, is an out-of-bounds write issue in the avdt_scb_hdl_write_req function of the avdt_scb_act.c file. This vulnerability occurs due to a heap buffer overflow, which can result in writing beyond the bounds of the allocated buffer. An attacker can exploit this vulnerability to escalate their privileges locally without requiring additional execution privileges. Notably, user interaction is not necessary for exploitation. The consequences of this vulnerability can range from unauthorized access to sensitive information to potential control over the affected device.
How To Fix
Minimum fixed version
13-next:2023-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the fix provided by updating the package to the fixed version.
Conclusion
In conclusion, the platform/packages/modules/Bluetooth package in the Android ecosystem is vulnerable to an out-of-bounds write issue in the avdt_scb_hdl_write_req function. This vulnerability can be exploited to escalate privileges locally without requiring additional execution privileges. It is crucial to update the package to the fixed version to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
This vulnerability can lead to local privilege escalation, allowing an attacker to gain elevated privileges on the affected device.
No, user interaction is not needed for exploitation of this vulnerability.
Versions 11, 12, 12L, and 13 of the Android platform are affected by this vulnerability.
AVDTP (Audio/Video Distribution Transport Protocol) is a Bluetooth profile used for streaming audio and video content over Bluetooth connections.
This vulnerability is classified as High severity.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
