CVE-2023-35658: Use-After-Free in Bluetooth GATT
Summary
CVE-2023-35658: In gatt_process_prep_write_rsp of gatt_cl.cc, there is a possible privilege escalation due to a use after free. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2023-09-01
>= 13-next:0, < 13-next:2023-09-01
Fixed in 13-next:2023-09-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth package in the Android ecosystem is responsible for handling Bluetooth functionality on Android devices. It provides APIs and services for Bluetooth communication, including the Generic Attribute Profile (GATT) protocol. GATT is used for data exchange between Bluetooth devices, allowing them to discover and interact with each other's services and characteristics. This vulnerability affects the GATT implementation in the Bluetooth package.
Vulnerability Detail
The vulnerability, identified as CVE-2023-35658, resides in the function gatt_process_prep_write_rsp within the GATT implementation of the Bluetooth package. It is categorized as a use-after-free vulnerability. When processing a prepare write response, the function fails to properly handle memory deallocation, leading to a situation where a reference to freed memory is still accessible. An attacker within proximity of the affected device can exploit this vulnerability to escalate privileges remotely, potentially achieving code execution without requiring additional privileges or user interaction.
How To Fix
Minimum fixed version
13-next:2023-09-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability. It is crucial to apply the official fix to mitigate the risk of exploitation.
Conclusion
The use-after-free vulnerability in the Bluetooth GATT implementation poses a critical security risk, allowing for remote code execution without user interaction. It is crucial to apply the provided fix to ensure the proper handling of memory within the affected function. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
The vulnerability allows an attacker in close proximity to the affected device to execute arbitrary code remotely, potentially leading to a complete compromise of the device.
No, user interaction is not needed for the vulnerability to be exploited. An attacker within proximity can trigger the vulnerability without any user involvement.
The vulnerability affects Android versions 11, 12, 12L, and 13.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, including those in the Android ecosystem.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
