In btmsecconnected and btmsecdisconnected of btm_sec.cc file , there is a possible use after free. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
{ "fixes": [ "https://android.googlesource.com/platform/system/bt/+/4f3fdf141b248cacd7c7dd09c06d058931726c98" ], "vanir_signatures": [ { "signature_type": "Function", "id": "ASB-A-201083442-1b29831b", "deprecated": false, "digest": { "length": 2932.0, "function_hash": "122004041837697648258448318484223466279" }, "target": { "file": "stack/btm/btm_sec.cc", "function": "btm_sec_disconnected" }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/system/bt/+/4f3fdf141b248cacd7c7dd09c06d058931726c98" }, { "signature_type": "Function", "id": "ASB-A-201083442-49f83b77", "deprecated": false, "digest": { "length": 6878.0, "function_hash": "48152161687422866557800725042663174574" }, "target": { "file": "stack/btm/btm_sec.cc", "function": "btm_sec_connected" }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/system/bt/+/4f3fdf141b248cacd7c7dd09c06d058931726c98" }, { "signature_type": "Line", "id": "ASB-A-201083442-5d9eae03", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "297368654972908621836918557900222963549", "332322776207264410706621514063170894526", "338335156206453636038296674831092072979", "304783868903325475174910602552010287361", "237584898535526165343205144234369001840", "182461076222023272195598206281586249700", "225770881008579576306811599978284230743", "157159581754704635677698335972200630708", "261046882585634627809982276669943056732", "170262317928811187330531501478672008062", "90216770933488751888883760906353042346", "293663843391815631228309343007137271692", "79779840663977586246070583226410737972", "98096397884023612276246776154760033515" ] }, "target": { "file": "stack/btm/btm_sec.cc" }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/system/bt/+/4f3fdf141b248cacd7c7dd09c06d058931726c98" } ], "spl": "2022-02-01", "types": [ "EoP" ], "severity": "High" }
{ "fixes": [ "https://android.googlesource.com/platform/system/bt/+/c08175b5f15b161a6ba1444e1071e92b03552915" ], "vanir_signatures": [ { "signature_type": "Function", "id": "ASB-A-201083442-08db4922", "deprecated": false, "digest": { "length": 6923.0, "function_hash": "76536728077887636859201998616180283151" }, "target": { "file": "stack/btm/btm_sec.cc", "function": "btm_sec_connected" }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/system/bt/+/c08175b5f15b161a6ba1444e1071e92b03552915" }, { "signature_type": "Line", "id": "ASB-A-201083442-b8128c5a", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "297368654972908621836918557900222963549", "332322776207264410706621514063170894526", "338335156206453636038296674831092072979", "304783868903325475174910602552010287361", "237584898535526165343205144234369001840", "182461076222023272195598206281586249700", "225770881008579576306811599978284230743", "157159581754704635677698335972200630708", "261046882585634627809982276669943056732", "170262317928811187330531501478672008062", "90216770933488751888883760906353042346", "293663843391815631228309343007137271692", "79779840663977586246070583226410737972", "98096397884023612276246776154760033515" ] }, "target": { "file": "stack/btm/btm_sec.cc" }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/system/bt/+/c08175b5f15b161a6ba1444e1071e92b03552915" }, { "signature_type": "Function", "id": "ASB-A-201083442-fcb3b15a", "deprecated": false, "digest": { "length": 2932.0, "function_hash": "122004041837697648258448318484223466279" }, "target": { "file": "stack/btm/btm_sec.cc", "function": "btm_sec_disconnected" }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/system/bt/+/c08175b5f15b161a6ba1444e1071e92b03552915" } ], "spl": "2022-02-01", "types": [ "EoP" ], "severity": "High" }
{ "fixes": [ "https://android.googlesource.com/platform/system/bt/+/ea8501068cc35af7aa5945e9b066130f02dc06a4" ], "vanir_signatures": [ { "signature_type": "Line", "id": "ASB-A-201083442-4651c542", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "94915954982532662455959577836117386052", "250075224066749656933134517146766345018", "284970515002573275106766199300817928614", "40005642885998785701529236771374408111", "193315777554132242213806373007094154933", "277305767727037183007718502432299055794", "274509028261151890536959334243696074865" ] }, "target": { "file": "stack/btm/btm_sec.cc" }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/system/bt/+/ea8501068cc35af7aa5945e9b066130f02dc06a4" }, { "signature_type": "Function", "id": "ASB-A-201083442-521c2e50", "deprecated": false, "digest": { "length": 6149.0, "function_hash": "264728479579913994476960157247978928619" }, "target": { "file": "stack/btm/btm_sec.cc", "function": "btm_sec_connected" }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/system/bt/+/ea8501068cc35af7aa5945e9b066130f02dc06a4" } ], "spl": "2022-02-01", "types": [ "EoP" ], "severity": "High" }