In multiple locations, there is a possible way to impersonate and MitM a device across session by only compromising one session key due to an insecure protocol design on Bluetooth Legacy Secure Connection (LSC). This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "vanir_signatures": [ { "signature_type": "Line", "deprecated": false, "target": { "file": "system/gd/discovery/device/bt_property.cc" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "307859322362080207797449175749469137790", "72053527313465416699379033665241342303", "125293479238145833784442092162860426596", "4821652172667453333237179809740615606", "42118158122847526867070859623136552698", "275304083674818758113614014475905030259", "6697695284814467484457899050442182500", "155867319312689859244460911816283323594" ] }, "id": "ASB-A-255601934-07ac7ff6", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ec6e086f7aff3a69084fd295d9212405c419f4f1" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "system/stack/btm/btm_sec.cc", "function": "read_encryption_key_size_complete_after_encryption_change" }, "signature_version": "v1", "digest": { "length": 867.0, "function_hash": "192036310639863789364790573944925280343" }, "id": "ASB-A-255601934-0d918186", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/27a98dc04a5d17a9ba1fb4a857159f96fd7ddf57" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "system/stack/btm/btm_sec.cc", "function": "btm_sec_encryption_change_evt" }, "signature_version": "v1", "digest": { "length": 630.0, "function_hash": "251646905426464761474575927421786518356" }, "id": "ASB-A-255601934-1a6277bf", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/27a98dc04a5d17a9ba1fb4a857159f96fd7ddf57" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "system/stack/btm/btm_sec.cc", "function": "btm_sec_link_key_notification" }, "signature_version": "v1", "digest": { "length": 2761.0, "function_hash": "19872724385398095221466670633100208731" }, "id": "ASB-A-255601934-2734552f", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/a7b20aa0461c7821e71da59994c488e981286c4f" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "system/btif/src/btif_storage.cc", "function": "cfg2prop" }, "signature_version": "v1", "digest": { "length": 4327.0, "function_hash": "80013140319451331480798569473583061824" }, "id": "ASB-A-255601934-62efce38", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ec6e086f7aff3a69084fd295d9212405c419f4f1" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "system/gd/discovery/device/bt_property.cc", "function": "bt_property_text" }, "signature_version": "v1", "digest": { "length": 7288.0, "function_hash": "269658695933287352188521259888996094244" }, "id": "ASB-A-255601934-68716d95", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ec6e086f7aff3a69084fd295d9212405c419f4f1" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "system/btif/src/btif_storage.cc" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "271713957833132500284859582077776595973", "185079335864954599635056483894580396987", "259934367459573055035572230294490990661", "64022465945383989523120079495099506453", "223255349308782055939198443694958802927", "207348041105018471297829264430204966412", "64022465945383989523120079495099506453" ] }, "id": "ASB-A-255601934-6c2529b9", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ec6e086f7aff3a69084fd295d9212405c419f4f1" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "system/gd/discovery/device/bt_property.cc", "function": "bt_property_type_text" }, "signature_version": "v1", "digest": { "length": 1257.0, "function_hash": "245406557672564561279718474975691961357" }, "id": "ASB-A-255601934-83faec4c", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ec6e086f7aff3a69084fd295d9212405c419f4f1" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "system/stack/btm/btm_sec.cc" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "183539417381995701332836344943378234116", "299147462572040800246950850379068373135", "118356800023287091881050720431421379039", "162030735479522582195806332496572897642", "131265421223171649541435952235685436623", "121199602994852658908394742479708137076", "313418489699119733168429186884482837218", "88619650369194078289526096819057185748", "40424054717462005280391661262148621874", "75763297552917749374956787290176292360", "252332093209313967302851536606494872402", "21759528560398753752590232050509102324", "295908970347471970097454705625370153284", "223578403248290363961226153162079683741", "96304884812632926493100882662817960865", "275102057869858223072653072790448972313", "37839678007238590105928558000554638541", "245371739567233439006035569549586504986", "136236089501018989931959179928983699181", "59385189520621305596614373120956389399", "79627190185876258407199479915798227888", "83384752079204723038531306312555258030", "39821973001360230086774683237342256159" ] }, "id": "ASB-A-255601934-97d860db", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/27a98dc04a5d17a9ba1fb4a857159f96fd7ddf57" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "system/btif/src/btif_storage.cc", "function": "prop2cfg" }, "signature_version": "v1", "digest": { "length": 3218.0, "function_hash": "248889146994289603826627655633080873889" }, "id": "ASB-A-255601934-9a9c0cba", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ec6e086f7aff3a69084fd295d9212405c419f4f1" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "system/include/hardware/bluetooth.h" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "315030879071375133054368253580225023517", "247152168946879982255665633100187140513", "302553487751548630100246514958293823369" ] }, "id": "ASB-A-255601934-9c5590b9", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ec6e086f7aff3a69084fd295d9212405c419f4f1" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "system/stack/btm/btm_sec.cc", "function": "btm_sec_set_peer_sec_caps" }, "signature_version": "v1", "digest": { "length": 1186.0, "function_hash": "34042918372928184712867818031781300812" }, "id": "ASB-A-255601934-a47fe45c", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/a7b20aa0461c7821e71da59994c488e981286c4f" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "system/stack/btm/btm_sec.cc" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "266518652139487802708290737029489096598", "37384305349746809542343254806354430458", "160646917072820612036094467799566921100", "231753081693157753132566988043203408933", "211926544223690950016090077572782305963", "36712328079894929057778474188527777831", "167199451087032965343524249778862240365" ] }, "id": "ASB-A-255601934-be4125a7", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/a7b20aa0461c7821e71da59994c488e981286c4f" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "system/stack/btm/btm_sec.cc" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "149648559808077086208624284283962657203", "147340885857168230401474569179246954752", "199181595740153212529563352211015706342" ] }, "id": "ASB-A-255601934-c7e4ed46", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ec6e086f7aff3a69084fd295d9212405c419f4f1" } ], "types": [ "EoP" ], "severity": "High", "spl": "2025-09-01", "fixes": [ "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ec6e086f7aff3a69084fd295d9212405c419f4f1", "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/a7b20aa0461c7821e71da59994c488e981286c4f", "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/27a98dc04a5d17a9ba1fb4a857159f96fd7ddf57" ] }
{ "vanir_signatures": [ { "signature_type": "Function", "deprecated": false, "target": { "file": "system/stack/btm/btm_sec.cc", "function": "btm_sec_set_peer_sec_caps" }, "signature_version": "v1", "digest": { "length": 1451.0, "function_hash": "336770119033974351632010443559142458535" }, "id": "ASB-A-255601934-34abb354", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d82f9ffa1181f48e6467ab518033d92a8d24a0c3" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "system/stack/btm/btm_sec.cc", "function": "read_encryption_key_size_complete_after_encryption_change" }, "signature_version": "v1", "digest": { "length": 1349.0, "function_hash": "310445219106930433305812412997294478871" }, "id": "ASB-A-255601934-51e0a886", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d82f9ffa1181f48e6467ab518033d92a8d24a0c3" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "system/stack/btm/btm_sec.cc", "function": "btm_sec_link_key_notification" }, "signature_version": "v1", "digest": { "length": 3155.0, "function_hash": "253626688862638539837923608898309793236" }, "id": "ASB-A-255601934-57a68175", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d82f9ffa1181f48e6467ab518033d92a8d24a0c3" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "system/stack/btm/btm_sec.cc", "function": "btm_sec_encryption_change_evt" }, "signature_version": "v1", "digest": { "length": 1319.0, "function_hash": "99222357294263669588746309439108974960" }, "id": "ASB-A-255601934-76719392", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d82f9ffa1181f48e6467ab518033d92a8d24a0c3" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "system/stack/btm/btm_sec.cc" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "70864543297806922951840412038613254182", "230737101160761232395765402908905319128", "239684520804316641482359816652480181767", "21722759985662331609553657737532750278", "51231322028862147627386953633323396300", "61910380008107921675816284260487544338", "258339525062796621465626831829468847907", "185793465556896370045076271772997679285", "280849930823276728787940719719863131017", "310565447040671705010632515846450762837", "205450310021617851735525832792213115321", "226822154492271008146970512793999362159", "128228250310744309884907073799106916815", "285716360563714955771574435957541769691", "327709942547889814995409786382715896156", "12649358734445037645837135595738788727", "118356800023287091881050720431421379039", "52619197769979135914564792226781508513", "35589894760019436874852070714737407300", "283391187902227712971555219506232269048", "174789060523713061597767307275744318710", "182375193236904693098705214574166391117", "267593862329867414160354593844005422319", "177958181160150866053231598315364981436", "78945951057668929498339147086504160763", "21759528560398753752590232050509102324", "295908970347471970097454705625370153284", "223578403248290363961226153162079683741", "96304884812632926493100882662817960865", "275102057869858223072653072790448972313", "37839678007238590105928558000554638541", "245371739567233439006035569549586504986", "136236089501018989931959179928983699181", "131359856419217416393325546937123558037", "154398036439707699732950693620684533040", "23472365298188449805531283985580584982", "276525821094107817444479305435542567847", "78926681104404981566884447535873971484", "228380430312375053875523143857945633838", "284368830091018735984329189017391854936", "268283699743707698039834660916284993740", "141585009430810694088907706561486213270", "225265497575064827532972069684104255393", "227560685823192452090698130309061077278", "59461990019374960499842676249975085896", "19386335263334776145538743473170540816", "130333226609440465854867188182437512389", "21759528560398753752590232050509102324", "295908970347471970097454705625370153284", "223578403248290363961226153162079683741", "96304884812632926493100882662817960865", "275102057869858223072653072790448972313", "37839678007238590105928558000554638541", "245371739567233439006035569549586504986", "136236089501018989931959179928983699181", "131359856419217416393325546937123558037", "154398036439707699732950693620684533040", "23472365298188449805531283985580584982", "106624338438329514597676167485934696645", "57653994748984369492239723297976696991", "15093542233227946141128895304320383617", "106248176381009313464482200040072502951", "36029938787696422002966316396228044183", "190619981604917629836905108828022183440", "267940758693250131981683501745114396700", "171304030208587777934480659465344787435", "310938057104960214923231798717406573508", "201604140851152577843307166957433689762", "226174342126596289922822034727107069866", "98953452689190376294717960487843988292", "273814561663020183333689431887952473703", "224313753484028072451060792460961684951", "81529400001607515073449728412430023511", "86120088767775132594437602309897427570", "133651994684250336862630691700331605898", "312814422296964111583340118685679004048", "186134282469479720400100706589916072349" ] }, "id": "ASB-A-255601934-9fbe10c1", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d82f9ffa1181f48e6467ab518033d92a8d24a0c3" } ], "types": [ "EoP" ], "severity": "High", "spl": "2025-09-01", "fixes": [ "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d82f9ffa1181f48e6467ab518033d92a8d24a0c3" ] }
{ "vanir_signatures": [ { "signature_type": "Line", "deprecated": false, "target": { "file": "system/service/logging_helpers.cc" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "242563290659721666685637412767050333149", "32908986244399928898934535466964051119", "228706962256835610633790890275133993341", "94657860183907572562020114099511553050" ] }, "id": "ASB-A-255601934-0101bec1", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3cf3d9d98909787748e6135733b42be0c67e9333" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "system/stack/btm/btm_sec.cc", "function": "btm_sec_set_peer_sec_caps" }, "signature_version": "v1", "digest": { "length": 1168.0, "function_hash": "260039993260964292529126231259584420490" }, "id": "ASB-A-255601934-038a77a7", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f20fdd9b3225a6084f6b666172817fe0a89f0679" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "system/stack/btm/btm_sec.cc", "function": "btm_sec_link_key_notification" }, "signature_version": "v1", "digest": { "length": 2517.0, "function_hash": "84044395077285259339322161272375542021" }, "id": "ASB-A-255601934-1005f186", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f20fdd9b3225a6084f6b666172817fe0a89f0679" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "system/stack/include/sec_hci_link_interface.h" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "242218188798706304966162717094307458392", "337184668011185998839087110108900280237", "245594573820906580234011890216501039462", "294811543351173061293372336569918908644", "294595388959983195204004624900993820728", "152565031780846908346853249931452730492" ] }, "id": "ASB-A-255601934-1fbe4107", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3cf3d9d98909787748e6135733b42be0c67e9333" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "system/include/hardware/bluetooth.h" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "209703163697001874740023071685729004211", "232957102806530419503826750689648667147", "221677954230406792762719541506710585528" ] }, "id": "ASB-A-255601934-2e4f2d71", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3cf3d9d98909787748e6135733b42be0c67e9333" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "system/stack/btu/btu_hcif.cc", "function": "read_encryption_key_size_complete_after_encryption_change" }, "signature_version": "v1", "digest": { "length": 1014.0, "function_hash": "283098555717915647344786166871622381307" }, "id": "ASB-A-255601934-2f2a2519", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d6e9fdf182afb57cecac6c56603aa20d758090a4" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "system/btif/src/btif_storage.cc" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "26991000918010011293032425820194375858", "189540976721447778448066271083184349028", "114953138903427366747704093442747913243", "152827145581683759655223785041644946194", "82007387664674466171158735067380690685", "78983520421745183782436002717738920614", "309784763341066577726294363779444586788", "72088800650105368106146960956353339725", "329860751966129528621026710034617788364", "88689348947308001212701445799343332795" ] }, "id": "ASB-A-255601934-3632f65d", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3cf3d9d98909787748e6135733b42be0c67e9333" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "system/stack/btu/btu_hcif.cc" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "183539417381995701332836344943378234116", "299147462572040800246950850379068373135", "118356800023287091881050720431421379039" ] }, "id": "ASB-A-255601934-39c597a9", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d6e9fdf182afb57cecac6c56603aa20d758090a4" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "system/btif/src/btif_storage.cc", "function": "cfg2prop" }, "signature_version": "v1", "digest": { "length": 3180.0, "function_hash": "9222992543202136306393375138118441007" }, "id": "ASB-A-255601934-470509be", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3cf3d9d98909787748e6135733b42be0c67e9333" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "system/service/logging_helpers.cc", "function": "BtPropertyText" }, "signature_version": "v1", "digest": { "length": 716.0, "function_hash": "213519277432244735406161172050741378735" }, "id": "ASB-A-255601934-78c868b1", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3cf3d9d98909787748e6135733b42be0c67e9333" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "system/stack/btm/btm_sec.cc" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "333784887719667078540628984785384295142", "262494758321276919138774996925706688322", "145010911038815893642611780205149456490", "211926544223690950016090077572782305963", "36712328079894929057778474188527777831", "167199451087032965343524249778862240365" ] }, "id": "ASB-A-255601934-7f69c6da", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f20fdd9b3225a6084f6b666172817fe0a89f0679" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "system/stack/btm/btm_sec.cc" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "292963404111669514668204024209415706130", "139379922343337349780525200726630051949", "199181595740153212529563352211015706342" ] }, "id": "ASB-A-255601934-8d849fc0", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3cf3d9d98909787748e6135733b42be0c67e9333" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "system/test/mock/mock_stack_btm_sec.cc" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "192539092243989731606453975127444223619", "215849411271825391588747248054161521888", "201390268950632391526350907188081762817", "234889703097580829074129021724127416019", "182877132451108892180164454980873313343", "86981486128047264625509232329444262606", "260623560685414483858031941513047635257", "211813761810435549132158560842369888961" ] }, "id": "ASB-A-255601934-9d6ba22f", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3cf3d9d98909787748e6135733b42be0c67e9333" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "system/btif/src/btif_storage.cc", "function": "prop2cfg" }, "signature_version": "v1", "digest": { "length": 2687.0, "function_hash": "272118617284143972222547531898474029578" }, "id": "ASB-A-255601934-aaa139ef", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3cf3d9d98909787748e6135733b42be0c67e9333" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "system/stack/btm/btm_sec.h" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "327171170397957981596565205401745445407" ] }, "id": "ASB-A-255601934-d07e8977", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3cf3d9d98909787748e6135733b42be0c67e9333" } ], "types": [ "EoP" ], "severity": "High", "spl": "2025-09-01", "fixes": [ "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3cf3d9d98909787748e6135733b42be0c67e9333", "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f20fdd9b3225a6084f6b666172817fe0a89f0679", "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d6e9fdf182afb57cecac6c56603aa20d758090a4" ] }
{ "vanir_signatures": [ { "signature_type": "Line", "deprecated": false, "target": { "file": "system/stack/include/sec_hci_link_interface.h" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "242218188798706304966162717094307458392", "337184668011185998839087110108900280237", "245594573820906580234011890216501039462", "294811543351173061293372336569918908644", "294595388959983195204004624900993820728", "152565031780846908346853249931452730492" ] }, "id": "ASB-A-255601934-10a01091", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c17811e6a2357eb34368a1a0a6ed5dec19d980ed" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "system/stack/btm/btm_sec.cc", "function": "btm_sec_set_peer_sec_caps" }, "signature_version": "v1", "digest": { "length": 1168.0, "function_hash": "260039993260964292529126231259584420490" }, "id": "ASB-A-255601934-1b5c1395", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f20fdd9b3225a6084f6b666172817fe0a89f0679" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "system/test/mock/mock_stack_btm_sec.cc" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "333614743832161691103930401852862058421", "311706389375406362665303640414909446385", "109104143866606579365611810569985583032", "68245379686805045392811081359420824485", "183628573873281659167091615010805935220", "280125042207296525718754066588189475521", "218744796855340387143677427451118594157", "113579924642961639524025675867170208597" ] }, "id": "ASB-A-255601934-1e866643", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c17811e6a2357eb34368a1a0a6ed5dec19d980ed" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "system/stack/btm/btm_sec.cc", "function": "btm_sec_link_key_notification" }, "signature_version": "v1", "digest": { "length": 2517.0, "function_hash": "84044395077285259339322161272375542021" }, "id": "ASB-A-255601934-221d84f9", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f20fdd9b3225a6084f6b666172817fe0a89f0679" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "system/btif/src/btif_storage.cc", "function": "cfg2prop" }, "signature_version": "v1", "digest": { "length": 4091.0, "function_hash": "192365877331407250858510953935564745054" }, "id": "ASB-A-255601934-3729447e", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c17811e6a2357eb34368a1a0a6ed5dec19d980ed" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "system/stack/btm/btm_sec.cc" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "292963404111669514668204024209415706130", "139379922343337349780525200726630051949", "199181595740153212529563352211015706342" ] }, "id": "ASB-A-255601934-43ea1720", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c17811e6a2357eb34368a1a0a6ed5dec19d980ed" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "system/include/hardware/bluetooth.h" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "24710913521688938654381696910091348185", "292853786092863430800844832862970606021", "239013003512542504166638160687724282222" ] }, "id": "ASB-A-255601934-6e8af461", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c17811e6a2357eb34368a1a0a6ed5dec19d980ed" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "system/stack/btu/btu_hcif.cc" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "183539417381995701332836344943378234116", "299147462572040800246950850379068373135", "118356800023287091881050720431421379039" ] }, "id": "ASB-A-255601934-872d7129", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d6e9fdf182afb57cecac6c56603aa20d758090a4" }, { "match_only_versions": [ "14" ], "deprecated": false, "target": { "file": "system/test/headless/bt_property.cc", "function": "process_property" }, "signature_type": "Function", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c17811e6a2357eb34368a1a0a6ed5dec19d980ed", "digest": { "length": 2766.0, "function_hash": "71755488795073732570287104322292100068" }, "signature_version": "v1", "id": "ASB-A-255601934-8e24539f" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "system/btif/src/btif_storage.cc" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "212839294808911090569161042050693983306", "137302665148723637870151882174628280020", "158025624802276785009112694952686087496", "168848803250158326409429959431264874942", "338543194716530183361991376775874458188", "340204006865441747740170226884380170663", "271051654872015077801363693365018316485", "287022318898783465240092764242204313370", "262951369759386536519354703093914377794", "329860751966129528621026710034617788364", "88689348947308001212701445799343332795" ] }, "id": "ASB-A-255601934-98ee015d", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c17811e6a2357eb34368a1a0a6ed5dec19d980ed" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "system/btif/src/btif_storage.cc", "function": "prop2cfg" }, "signature_version": "v1", "digest": { "length": 3204.0, "function_hash": "46475381525285367036165361012817888515" }, "id": "ASB-A-255601934-99dedae9", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c17811e6a2357eb34368a1a0a6ed5dec19d980ed" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "system/stack/btu/btu_hcif.cc", "function": "read_encryption_key_size_complete_after_encryption_change" }, "signature_version": "v1", "digest": { "length": 1014.0, "function_hash": "283098555717915647344786166871622381307" }, "id": "ASB-A-255601934-9e8693e9", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d6e9fdf182afb57cecac6c56603aa20d758090a4" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "system/stack/btm/btm_sec.h" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "327171170397957981596565205401745445407" ] }, "id": "ASB-A-255601934-a2fb5f73", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c17811e6a2357eb34368a1a0a6ed5dec19d980ed" }, { "match_only_versions": [ "14" ], "deprecated": false, "target": { "file": "system/test/headless/bt_property.cc" }, "signature_type": "Line", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c17811e6a2357eb34368a1a0a6ed5dec19d980ed", "digest": { "threshold": 0.9, "line_hashes": [ "331722919100343026004263985364151025886", "207938745105179613957043220861061433786", "264712830994300752275677241892333529291", "121317821217468388857619726254563091060" ] }, "signature_version": "v1", "id": "ASB-A-255601934-c0878d39" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "system/stack/btm/btm_sec.cc" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "333784887719667078540628984785384295142", "262494758321276919138774996925706688322", "145010911038815893642611780205149456490", "211926544223690950016090077572782305963", "36712328079894929057778474188527777831", "167199451087032965343524249778862240365" ] }, "id": "ASB-A-255601934-d5a4f47a", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f20fdd9b3225a6084f6b666172817fe0a89f0679" } ], "types": [ "EoP" ], "severity": "High", "spl": "2025-09-01", "fixes": [ "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c17811e6a2357eb34368a1a0a6ed5dec19d980ed", "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f20fdd9b3225a6084f6b666172817fe0a89f0679", "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d6e9fdf182afb57cecac6c56603aa20d758090a4" ] }