Unauthenticated Bluetooth keystroke-injection in Pixel 7 running AP11.231117.006

2024-03-0100:00:00

Google

osv.dev

bluetooth

keystroke injection

pixel 7

security vulnerability

improper input validation

privilege escalation

7.7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

In access_secure_service_from_temp_bond of btm_sec.cc, there is a possible way to achieve keystroke injection due to improper input validation. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CPENameOperatorVersion
platform/packages/modules/bluetootheq13
platform/packages/modules/bluetootheq12
platform/packages/modules/bluetootheq14
platform/packages/modules/bluetootheq12L

Name	Operator	Version
platform/packages/modules/bluetooth	eq	13
platform/packages/modules/bluetooth	eq	12
platform/packages/modules/bluetooth	eq	14
platform/packages/modules/bluetooth	eq	12L