In btaavconfigind of btaav_aact.cc, there is a possible out of bounds read due to type confusion. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "vanir_signatures": [ { "digest": { "length": 497.0, "function_hash": "16960945942744483288779341569105289904" }, "id": "ASB-A-260230151-10c0414d", "source": "https://googleplex-android.googlesource.com/platform/packages/modules/Bluetooth/+/d5ec52732410406d4adf6bab85bb981f836b32dc", "deprecated": false, "signature_version": "v1", "target": { "file": "system/bta/av/bta_av_aact.cc", "function": "bta_av_setconfig_rej" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "24722393924068985003472469871278814224", "91996796257887544603553692058525565990", "232575053746628639781353200377541806808", "52369250472187051960610881616222735489", "97144488170958606537098860304510512672", "152846350169814279093831517277329438888", "54684041525377672883469224777743820816", "196470281291749717999253989053268998971", "260394036237009321628299211160613752655", "326749476786465189258828274847878856507", "85056414098347095732497647907352782528", "273978465967577292389321255542342081049", "16487139598688149776593751648832317610", "304324477403798901640468759292609307010", "43096468301225879277351137230515747921", "311288204852176252135823325347080670361", "64153222830176523055390062812597138582", "65675177733969015141694552234698361891", "143490395233177618047209890214700967367", "149340711416611300505655382141404456112" ] }, "id": "ASB-A-260230151-3484df1d", "source": "https://googleplex-android.googlesource.com/platform/packages/modules/Bluetooth/+/286538b8e52dbb8efd26ccdb240949ffeb3ad2b5", "deprecated": false, "signature_version": "v1", "target": { "file": "system/bta/av/bta_av_aact.cc" }, "signature_type": "Line" }, { "digest": { "length": 739.0, "function_hash": "115940089443962809550325303604834031068" }, "id": "ASB-A-260230151-494f7038", "source": "https://googleplex-android.googlesource.com/platform/packages/modules/Bluetooth/+/286538b8e52dbb8efd26ccdb240949ffeb3ad2b5", "deprecated": false, "signature_version": "v1", "target": { "file": "system/bta/av/bta_av_aact.cc", "function": "bta_av_setconfig_rej" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "38148001691759657804134104837309888917", "129693504356707904426038198799710253633", "334597965141643051274618653529164707699", "20493763997289717859754072174442169422", "162562487665790670067297569207094497737", "152846350169814279093831517277329438888", "54684041525377672883469224777743820816", "196470281291749717999253989053268998971" ] }, "id": "ASB-A-260230151-4e669df5", "source": "https://googleplex-android.googlesource.com/platform/packages/modules/Bluetooth/+/97c9c472f6b63b86bdf9cfd054490051e881c013", "deprecated": false, "signature_version": "v1", "target": { "file": "system/bta/av/bta_av_aact.cc" }, "signature_type": "Line" }, { "digest": { "length": 486.0, "function_hash": "332587188464506192292087593302759985103" }, "id": "ASB-A-260230151-8e13d122", "source": "https://googleplex-android.googlesource.com/platform/packages/modules/Bluetooth/+/97c9c472f6b63b86bdf9cfd054490051e881c013", "deprecated": false, "signature_version": "v1", "target": { "file": "system/bta/av/bta_av_aact.cc", "function": "bta_av_setconfig_rej" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "43637795621576944181473650082548683951", "189994263394856985670484093391554533803", "72349451366330368231205175023404075768", "136268239645180415597184079174962771346", "24144776941759346397084068370252343831", "75943171629679731922973348509685778195", "304324477403798901640468759292609307010", "43096468301225879277351137230515747921", "311288204852176252135823325347080670361", "38793563272626801603378424053565598491", "233366446562329169882718642036025467190", "200754103265358974279902326367101713911" ] }, "id": "ASB-A-260230151-a7fbbdf2", "source": "https://googleplex-android.googlesource.com/platform/packages/modules/Bluetooth/+/4dddbdda5ce8ee6bb04e6a518de20126b85b6119", "deprecated": false, "signature_version": "v1", "target": { "file": "system/bta/av/bta_av_aact.cc" }, "signature_type": "Line" }, { "digest": { "threshold": 0.9, "line_hashes": [ "47925593307657160469514984364341114999", "149641749152895584502001184186866016075", "267670287302059460702956949988702352847", "169429051243805734673656416741613359787", "291973683208436808477292632527695281086", "75943171629679731922973348509685778195", "304324477403798901640468759292609307010", "43096468301225879277351137230515747921", "311288204852176252135823325347080670361" ] }, "id": "ASB-A-260230151-c0239632", "source": "https://googleplex-android.googlesource.com/platform/packages/modules/Bluetooth/+/d5ec52732410406d4adf6bab85bb981f836b32dc", "deprecated": false, "signature_version": "v1", "target": { "file": "system/bta/av/bta_av_aact.cc" }, "signature_type": "Line" }, { "digest": { "length": 487.0, "function_hash": "285015544729865574002720717848431429603" }, "id": "ASB-A-260230151-d830902f", "source": "https://googleplex-android.googlesource.com/platform/packages/modules/Bluetooth/+/4dddbdda5ce8ee6bb04e6a518de20126b85b6119", "deprecated": false, "signature_version": "v1", "target": { "file": "system/bta/av/bta_av_aact.cc", "function": "bta_av_setconfig_rej" }, "signature_type": "Function" } ], "fixes": [ "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d5ec52732410406d4adf6bab85bb981f836b32dc", "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/97c9c472f6b63b86bdf9cfd054490051e881c013", "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4dddbdda5ce8ee6bb04e6a518de20126b85b6119", "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/286538b8e52dbb8efd26ccdb240949ffeb3ad2b5" ], "spl": "2025-05-01", "severity": "High", "types": [ "ID" ] }
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "75943171629679731922973348509685778195", "304324477403798901640468759292609307010", "43096468301225879277351137230515747921", "311288204852176252135823325347080670361" ] }, "id": "ASB-A-260230151-925c5b96", "source": "https://googleplex-android.googlesource.com/platform/packages/modules/Bluetooth/+/4cb4f37ffc89c8a143fffce0a26c48e31de1bbb8", "deprecated": false, "signature_version": "v1", "target": { "file": "system/bta/av/bta_av_aact.cc" }, "signature_type": "Line" }, { "digest": { "length": 487.0, "function_hash": "285015544729865574002720717848431429603" }, "id": "ASB-A-260230151-df6893ef", "source": "https://googleplex-android.googlesource.com/platform/packages/modules/Bluetooth/+/4cb4f37ffc89c8a143fffce0a26c48e31de1bbb8", "deprecated": false, "signature_version": "v1", "target": { "file": "system/bta/av/bta_av_aact.cc", "function": "bta_av_setconfig_rej" }, "signature_type": "Function" } ], "fixes": [ "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4cb4f37ffc89c8a143fffce0a26c48e31de1bbb8" ], "spl": "2025-05-01", "severity": "High", "types": [ "ID" ] }
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "227707895056148603516463919740528510145", "143946361298361834186525419292571018765", "37989374752585201082758080648018967642", "202454408074883958844014796457162960037" ] }, "id": "ASB-A-260230151-02fbe9af", "source": "https://googleplex-android.googlesource.com/platform/packages/modules/Bluetooth/+/a7cfdf76f02fa2b615a8c568c868370565463c76", "deprecated": false, "signature_version": "v1", "target": { "file": "system/bta/av/bta_av_aact.cc" }, "signature_type": "Line" }, { "digest": { "length": 494.0, "function_hash": "134393177023642745561840329805721414817" }, "id": "ASB-A-260230151-1c7aa437", "source": "https://googleplex-android.googlesource.com/platform/packages/modules/Bluetooth/+/bbd88e88ce749aab87178e189a05e5a356d0631c", "deprecated": false, "signature_version": "v1", "target": { "file": "system/bta/av/bta_av_aact.cc", "function": "bta_av_setconfig_rej" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "168944574313951584934841120728294238908", "274000373511619465058470520106006606681", "90483408705858340780830632584376823652", "237278203730155847693486972272289701798", "20493763997289717859754072174442169422", "180467764108842910729813132978085692352", "112192355781258064684960702574471136442", "128264984640156559808813502809823338924", "11323686388328064446060580707189939283" ] }, "id": "ASB-A-260230151-4952a813", "source": "https://googleplex-android.googlesource.com/platform/packages/modules/Bluetooth/+/5a4c8f3bd96c822ef733fa0e2784af8713c8bdab", "deprecated": false, "signature_version": "v1", "target": { "file": "system/bta/av/bta_av_aact.cc" }, "signature_type": "Line" }, { "digest": { "length": 494.0, "function_hash": "134393177023642745561840329805721414817" }, "id": "ASB-A-260230151-9e66da25", "source": "https://googleplex-android.googlesource.com/platform/packages/modules/Bluetooth/+/a7cfdf76f02fa2b615a8c568c868370565463c76", "deprecated": false, "signature_version": "v1", "target": { "file": "system/bta/av/bta_av_aact.cc", "function": "bta_av_setconfig_rej" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "188494936330993502686196251953522837445", "15837631973841489353081313416406467550", "70479837834492215329942777949266173976", "169429051243805734673656416741613359787", "291973683208436808477292632527695281086", "227707895056148603516463919740528510145", "143946361298361834186525419292571018765", "37989374752585201082758080648018967642", "202454408074883958844014796457162960037" ] }, "id": "ASB-A-260230151-b84796a4", "source": "https://googleplex-android.googlesource.com/platform/packages/modules/Bluetooth/+/bbd88e88ce749aab87178e189a05e5a356d0631c", "deprecated": false, "signature_version": "v1", "target": { "file": "system/bta/av/bta_av_aact.cc" }, "signature_type": "Line" }, { "digest": { "length": 483.0, "function_hash": "312327279270915611920361484245614820499" }, "id": "ASB-A-260230151-f01ccdb9", "source": "https://googleplex-android.googlesource.com/platform/packages/modules/Bluetooth/+/5a4c8f3bd96c822ef733fa0e2784af8713c8bdab", "deprecated": false, "signature_version": "v1", "target": { "file": "system/bta/av/bta_av_aact.cc", "function": "bta_av_setconfig_rej" }, "signature_type": "Function" } ], "fixes": [ "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bbd88e88ce749aab87178e189a05e5a356d0631c", "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/5a4c8f3bd96c822ef733fa0e2784af8713c8bdab", "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/a7cfdf76f02fa2b615a8c568c868370565463c76" ], "spl": "2025-05-01", "severity": "High", "types": [ "ID" ] }
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "75943171629679731922973348509685778195", "304324477403798901640468759292609307010", "43096468301225879277351137230515747921", "311288204852176252135823325347080670361" ] }, "id": "ASB-A-260230151-81571018", "source": "https://googleplex-android.googlesource.com/platform/packages/modules/Bluetooth/+/b1bc3ea26b71ad7b32b29a001d6974ea6a99d02b", "deprecated": false, "signature_version": "v1", "target": { "file": "system/bta/av/bta_av_aact.cc" }, "signature_type": "Line" }, { "digest": { "length": 497.0, "function_hash": "16960945942744483288779341569105289904" }, "id": "ASB-A-260230151-8f3bbf07", "source": "https://googleplex-android.googlesource.com/platform/packages/modules/Bluetooth/+/b1bc3ea26b71ad7b32b29a001d6974ea6a99d02b", "deprecated": false, "signature_version": "v1", "target": { "file": "system/bta/av/bta_av_aact.cc", "function": "bta_av_setconfig_rej" }, "signature_type": "Function" } ], "fixes": [ "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b1bc3ea26b71ad7b32b29a001d6974ea6a99d02b" ], "spl": "2025-05-01", "severity": "High", "types": [ "ID" ] }