Bluetooth BTIF transcodeQ*ToFloat OOB Write
Summary
CVE-2023-40087: In transcodeQ*ToFloat of btif_avrcp_audio_track.cc, there is a possible out of bounds write due to a missing bounds check. Affects platform/packages/modules/Bluetooth across 3 version ranges.
>= 13:0, < 13:2023-12-01
>= 14:0, < 14:2023-12-01
>= 14-next:0, < 14-next:2023-12-01
Fixed in 14-next:2023-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth package in the Android ecosystem is responsible for managing Bluetooth functionality on Android devices. It provides APIs and modules for Bluetooth communication, including AVRCP (Audio/Video Remote Control Profile) for controlling audio playback on remote devices. This vulnerability affects the transcodeQ*ToFloat function in the btif_avrcp_audio_track.cc file. The function is responsible for converting audio data to floating-point format. The vulnerability arises due to a missing bounds check, which can result in an out-of-bounds write. This vulnerability can be exploited by a paired device to escalate privileges without requiring any additional execution privileges. User interaction is not necessary for exploitation.
Vulnerability Detail
The transcodeQ*ToFloat function in btif_avrcp_audio_track.cc lacks proper bounds checking, leading to an out-of-bounds write vulnerability. An attacker with a paired device can exploit this vulnerability to escalate privileges on the target device. The lack of bounds checking allows the attacker to write data beyond the allocated buffer, potentially overwriting critical memory regions. This could lead to arbitrary code execution or other malicious activities, depending on the attacker's intentions. The vulnerability affects Android versions 11 and above, with fixes available for versions 11, 12, 12L, 13, and 14.
How To Fix
Minimum fixed version
14-next:2023-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official fix provided by the package maintainers.
Conclusion
The Bluetooth BTIF transcodeQ*ToFloat OOB Write vulnerability in the Android Bluetooth package allows an attacker with a paired device to escalate privileges on the target device. This vulnerability can be fixed by updating the Bluetooth package to the latest version. No known workarounds are available. It is recommended to apply the official fix provided by the package maintainers. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
This vulnerability allows an attacker with a paired device to escalate privileges on the target Android device. The attacker can potentially execute arbitrary code or perform other malicious activities.
No, user interaction is not needed for exploitation of this vulnerability.
This vulnerability affects Android versions 11 and above.
The recommended mitigation is to update the Bluetooth package to the latest version that includes the fix for this vulnerability.
More information about this vulnerability can be found in the Android Open Source Vulnerability database: [link to vulnerability details].
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
