Lucene search

GoogleOSV:ASB-A-228602963

HistoryJan 01, 2023 - 12:00 a.m.

[Out of Bounds Read in pin_reply Function in bluetooth.cc in Bluetooth]

2023-01-0100:00:00

Google

osv.dev

pinreplynative

type confusion

local escalation

privilege

ble

exploitation

user interaction

software

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

5.1%

JSON

In pinReplyNative of com_android_bluetooth_btservice_AdapterService.cpp, there is a possible out of bounds read due to type confusion. This could lead to local escalation of privilege of BLE with no additional execution privileges needed. User interaction is not needed for exploitation.

CPENameOperatorVersion
platform/packages/modules/bluetootheq12L
platform/packages/modules/bluetootheq13
platform/packages/modules/bluetootheq11
platform/packages/modules/bluetootheq12
platform/packages/modules/bluetootheq10

Name	Operator	Version
platform/packages/modules/bluetooth	eq	12L
platform/packages/modules/bluetooth	eq	13
platform/packages/modules/bluetooth	eq	11
platform/packages/modules/bluetooth	eq	12
platform/packages/modules/bluetooth	eq	10

References

android.googlesource.com/platform/packages/modules/Bluetooth/+/2c09d202c83af6a511ad29ead37f4055760f095f

source.android.com/security/bulletin/2023-01-01

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for OSV:ASB-A-228602963