CVE-2023-20954: Heap OOB write of 0x00 in SDP_AddAttribute in Bluetooth
Summary
CVE-2023-20954: In SDP_AddAttribute of sdp_db.cc, there is a possible out of bounds write due to an incorrect bounds check. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2023-03-01
>= 13-next:0, < 13-next:2023-03-01
Fixed in 13-next:2023-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth package in the Android ecosystem is responsible for providing Bluetooth functionality to Android devices. It allows users to connect and communicate with other Bluetooth-enabled devices. This package is an integral part of the Android operating system and is present in multiple versions, starting from Android 11. However, a vulnerability has been discovered in the SDP_AddAttribute function of the Bluetooth package, which can lead to remote code execution without requiring any additional execution privileges. This vulnerability can be exploited without user interaction.
Vulnerability Detail
The vulnerability (CVE-2023-20954) resides in the SDP_AddAttribute function of the Bluetooth package. It is caused by an incorrect bounds check, resulting in a possible out-of-bounds write. An attacker can exploit this vulnerability remotely, potentially leading to the execution of arbitrary code on the affected device. The impact of this vulnerability is critical as it can compromise the security and integrity of the device, allowing an attacker to gain unauthorized access or perform malicious activities.
How To Fix
Minimum fixed version
13-next:2023-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can disable Bluetooth on their devices until the fix is applied. Disabling Bluetooth will prevent potential attackers from exploiting this vulnerability. However, this workaround may limit the functionality and convenience of using Bluetooth-enabled features on the device.
Conclusion
The vulnerability (CVE-2023-20954) in the Bluetooth package can lead to remote code execution on Android devices. It is crucial to update the Bluetooth package to the fixed versions to mitigate the risk of exploitation. Disabling Bluetooth can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
This vulnerability can lead to remote code execution on the affected device, potentially allowing an attacker to gain unauthorized access or perform malicious activities.
No, user interaction is not needed for exploitation of this vulnerability.
This vulnerability affects Android versions 11, 12, 12L, and 13.
There are no known instances of this vulnerability being exploited at the time of this report.
Yes, the fix for this vulnerability is available in the fixed versions of the Bluetooth package for Android 11, 12, 12L, and 13.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
