Bluetooth A2DP Vendor Opus Decoder Out-of-Bounds Access
Summary
CVE-2023-40078: In a2dp_vendor_opus_decoder_decode_packet of a2dp_vendor_opus_decoder.cc, there is a possible out of bounds write due to a heap buffer overflow. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 14:0, < 14:2023-12-01
>= 14-next:0, < 14-next:2023-12-01
Fixed in 14-next:2023-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth package in the Android ecosystem provides functionality for wireless communication between devices. It includes modules for various Bluetooth profiles, including the Advanced Audio Distribution Profile (A2DP) used for streaming high-quality audio. The A2DP Vendor Opus Decoder is responsible for decoding Opus audio packets received over Bluetooth. This vulnerability affects the a2dp_vendor_opus_decoder_decode_packet function in the Bluetooth package.
Vulnerability Detail
The a2dp_vendor_opus_decoder_decode_packet function in the Bluetooth package suffers from a heap buffer overflow, leading to an out-of-bounds write. This vulnerability allows an attacker to escalate privileges on a paired device without requiring additional execution privileges. Exploitation does not require user interaction. The vulnerability was introduced in version 14.0 of the Bluetooth package and was fixed in version 14.2023-12-01.
How To Fix
Minimum fixed version
14-next:2023-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Bluetooth A2DP Vendor Opus Decoder vulnerability allows for an out-of-bounds write, potentially leading to privileged escalation on a paired device. It is crucial to update the Bluetooth package to the fixed version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
This vulnerability allows an attacker to escalate privileges on a paired device without requiring additional execution privileges. It can potentially lead to unauthorized access to sensitive information or control over the device.
No, user interaction is not needed for exploitation of this vulnerability.
Versions 14.0 through 14.2023-12-01 of the Bluetooth package are affected by this vulnerability.
No workaround has been provided for this vulnerability. It is recommended to update to the fixed version of the Bluetooth package.
More information about this vulnerability can be found in the Android Open Source Vulnerabilities database: https://storage.googleapis.com/android-osv/ASB-A-275626001.json
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
