CVE-2023-21096: Use After Free Vulnerability in Android Bluetooth Module
Summary
CVE-2023-21096: In OnWakelockReleased of attribution_processor.cc, there is a use after free that could lead to remote code execution with no additional execution privileges needed. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2023-04-01
>= 13-next:0, < 13-next:2023-04-01
Fixed in 13-next:2023-04-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Bluetooth module is responsible for providing Bluetooth functionality on Android devices. It allows users to connect and communicate with Bluetooth devices such as headphones, speakers, and smartwatches. The module is an integral part of the Android operating system and is used by various applications and system services. However, a use after free vulnerability has been discovered in the Bluetooth module, which could potentially lead to remote code execution without requiring any additional execution privileges.
Vulnerability Detail
The use after free vulnerability exists in the OnWakelockReleased function of the attribution_processor.cc file in the Bluetooth module. This vulnerability occurs when a wakelock is released, and the AttributionProcessor attempts to process the event. Due to improper memory management, a reference to the released wakelock is still accessed, leading to a use after free condition. An attacker could exploit this vulnerability to execute arbitrary code on the affected device. The exploitation does not require any user interaction.
How To Fix
Minimum fixed version
13-next:2023-04-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is recommended to apply the official patches provided by the Android Open Source Project (AOSP) to ensure the security of the Bluetooth module.
Conclusion
The use after free vulnerability in the Android Bluetooth module poses a critical security risk as it allows for remote code execution without user interaction. It is crucial for users to update their devices to the latest version that includes the fix provided by the Android Open Source Project (AOSP). For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
This vulnerability could allow an attacker to execute arbitrary code on the affected device, potentially leading to a complete compromise of the device and unauthorized access to user data.
No, this vulnerability can be exploited without any user interaction.
Versions 12 and 13 of the Android platform are affected by this vulnerability.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your device is affected by this vulnerability. Simply visit the playground and enter the details of your device to receive an instant analysis.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
