CVE-2023-21250: Stack Buffer Overwrite in gatt_end_operation
Summary
CVE-2023-21250: In gatt_end_operation of gatt_utils.cc, there is a possible out of bounds write due to a missing bounds check. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2023-07-01
>= 13-next:0, < 13-next:2023-07-01
Fixed in 13-next:2023-07-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is 'platform/packages/modules/Bluetooth' in the Android ecosystem. This package is responsible for handling Bluetooth functionality in Android devices. It provides APIs and utilities for Bluetooth communication, including GATT (Generic Attribute Profile) operations. GATT is used for data exchange between Bluetooth devices. The vulnerability affects the 'gatt_end_operation' function in the 'gatt_utils.cc' file.
Vulnerability Detail
The vulnerability, identified as CVE-2023-21250, is a stack buffer overwrite issue in the 'gatt_end_operation' function of 'gatt_utils.cc'. The function lacks proper bounds checking, allowing an attacker to write data beyond the bounds of a buffer. This can lead to remote code execution without requiring additional execution privileges. Exploitation of this vulnerability does not require user interaction. The impact of this vulnerability can be severe, potentially enabling an attacker to execute arbitrary code on the affected device.
How To Fix
Minimum fixed version
13-next:2023-07-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability. It is crucial to apply the official patch to mitigate the risk of exploitation.
Conclusion
The 'platform/packages/modules/Bluetooth' package in the Android ecosystem is vulnerable to a stack buffer overwrite issue in the 'gatt_end_operation' function. This vulnerability can lead to remote code execution without requiring additional execution privileges. It is crucial to apply the provided patch to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
The vulnerability can lead to remote code execution on the affected device without requiring additional execution privileges. An attacker could potentially execute arbitrary code, compromising the security and integrity of the device.
No, user interaction is not needed for exploitation. An attacker can exploit this vulnerability remotely.
The vulnerability affects Android versions 11, 12, 12L, and 13.
Yes, a patch has been provided by the Android team. It is recommended to apply the patch to address the vulnerability.
You can find more information about this vulnerability in the Android Open Source Vulnerability database. The vulnerability details can be accessed at: https://storage.googleapis.com/android-osv/ASB-A-261068592.json
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
