CVE-2023-35673: Bluetooth GATT build_read_multi_rsp Integer Overflow
Summary
CVE-2023-35673: In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to an integer overflow. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2023-09-01
>= 13-next:0, < 13-next:2023-09-01
Fixed in 13-next:2023-09-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth package in the Android ecosystem is responsible for managing Bluetooth functionality on Android devices. It provides APIs and services for Bluetooth communication, including the Generic Attribute (GATT) protocol. GATT allows devices to exchange data and interact with Bluetooth Low Energy (BLE) devices. This vulnerability affects the build_read_multi_rsp function in the GATT server implementation of the Bluetooth package.
Vulnerability Detail
The build_read_multi_rsp function in gatt_sr.cc within the Bluetooth package is susceptible to an integer overflow vulnerability. This vulnerability can result in an out-of-bounds write, potentially leading to remote code execution. An attacker in proximity to the affected device can exploit this vulnerability without requiring any additional execution privileges or user interaction. The integer overflow occurs when processing a read request with a large attribute count, causing the write operation to exceed the bounds of the target buffer.
How To Fix
Minimum fixed version
13-next:2023-09-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability. It is recommended to apply the fix mentioned above.
Conclusion
The Bluetooth GATT build_read_multi_rsp integer overflow vulnerability poses a critical risk to Android devices. It allows for remote code execution without user interaction or additional privileges. It is crucial to apply the provided fix from the Android Open Source Project repository to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
This vulnerability can lead to remote code execution on the affected Android device. An attacker in proximity to the device can exploit the vulnerability without requiring any additional execution privileges or user interaction.
The vulnerability was introduced in version 11.0 of the Bluetooth package and affects all subsequent versions up to version 13.0.
No, user interaction is not needed for exploitation of this vulnerability.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
