Out of Bounds Write in BTM_BlePeriodicSyncTransfer in libbt-stack
Summary
CVE-2023-40080: In multiple functions of btm_ble_gap.cc, there is a possible out of bounds write due to a logic error in the code. Affects platform/packages/modules/Bluetooth across 3 version ranges.
>= 13:0, < 13:2023-12-01
>= 14:0, < 14:2023-12-01
>= 14-next:0, < 14-next:2023-12-01
Fixed in 14-next:2023-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth package in the Android ecosystem is responsible for managing Bluetooth functionality on Android devices. It provides APIs and services for Bluetooth communication between devices. The vulnerability affects the BTM_BlePeriodicSyncTransfer function in the libbt-stack library, which is used for periodic synchronization transfers in Bluetooth Low Energy (BLE) connections. BLE is a power-efficient version of Bluetooth designed for short-range communication between devices. The vulnerability allows for an out of bounds write due to a logic error in the code.
Vulnerability Detail
The vulnerability arises from a logic error in multiple functions of btm_ble_gap.cc. This flaw can be exploited locally to escalate privileges without requiring additional execution privileges. The vulnerability does not require user interaction for exploitation. An attacker could potentially leverage this vulnerability to gain unauthorized access or perform malicious actions on the affected device.
How To Fix
Minimum fixed version
14-next:2023-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to apply the fix mentioned in the 'how_to_fix' section.
Conclusion
In conclusion, the vulnerability in the BTM_BlePeriodicSyncTransfer function of the libbt-stack library in the Bluetooth package could allow for local privilege escalation. It is crucial to update the affected package to the fixed versions to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
The vulnerability could lead to local escalation of privilege, potentially allowing an attacker to gain unauthorized access or perform malicious actions on the affected device.
No, user interaction is not needed for exploitation of this vulnerability.
The vulnerability affects versions 13 and 14 of the Android ecosystem.
The severity of this vulnerability is classified as High.
More information about this vulnerability can be found in the Android Open Source Vulnerability database. The vulnerability ID is ASB-A-275057843.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
