Lucene search

GoogleOSV:ASB-A-239414876

HistoryJun 01, 2023 - 12:00 a.m.

[AOSP Bluetooth Use after free-bta_hf_client_sdp.cc-bta_hf_client_do_disc]

2023-06-0100:00:00

Google

osv.dev

aosp

bluetooth

vulnerability

sdp_discovery.cc

out of bounds write

use after free

remote code execution

hfp support

8.8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

26.4%

JSON

In sdpu_build_uuid_seq of sdp_discovery.cc, there is a possible out of bounds write due to a use after free. This could lead to remote code execution over Bluetooth, if HFP support is enabled, with no additional execution privileges needed. User interaction is not needed for exploitation.

CPENameOperatorVersion
platform/packages/modules/bluetootheq12L
platform/packages/modules/bluetootheq12
platform/packages/modules/bluetootheq13
platform/packages/modules/bluetootheq11

Name	Operator	Version
platform/packages/modules/bluetooth	eq	12L
platform/packages/modules/bluetooth	eq	12
platform/packages/modules/bluetooth	eq	13
platform/packages/modules/bluetooth	eq	11

References

android.googlesource.com/platform/packages/modules/Bluetooth/+/bb458314f98712c39749f8e2fae42df864bf5347

source.android.com/security/bulletin/2023-06-01

8.8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

26.4%

JSON

Related for OSV:ASB-A-239414876