In multiple locations, there is a possible bypass of user consent to enabling new Bluetooth HIDs due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135"
],
"severity": "High",
"types": [
"EoP"
],
"vanir_signatures": [
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135",
"signature_version": "v1",
"id": "ASB-A-308429049-018b943a",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"225248484501167241263529534673073971315",
"72029136021544760177668659079629039595",
"181881416923704576084282559136696827352"
]
},
"deprecated": false,
"target": {
"file": "system/btif/include/btif_storage.h"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135",
"signature_version": "v1",
"id": "ASB-A-308429049-053f8b2d",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"108483140622762840761252473352879087736",
"92321261922023850310873916168711306105",
"208512423671106555842603402292705464054",
"29357230793833980083684887722416901494",
"151394948645309531335032097935128175703",
"273657911209795218425148159180696707729",
"108740058939617127469900139319670900885",
"111488344450951130654573380800421075538"
]
},
"deprecated": false,
"target": {
"file": "android/app/src/com/android/bluetooth/hid/HidHostService.java"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135",
"signature_version": "v1",
"id": "ASB-A-308429049-078a2430",
"signature_type": "Function",
"digest": {
"function_hash": "215041838826125737418862833033085942707",
"length": 556.0
},
"deprecated": false,
"target": {
"function": "disconnectHidNative",
"file": "android/app/jni/com_android_bluetooth_hid_host.cpp"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135",
"signature_version": "v1",
"id": "ASB-A-308429049-09ad8b4b",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"26991000918010011293032425820194375858",
"189540976721447778448066271083184349028",
"114953138903427366747704093442747913243",
"11210350231520943643999824683593482146",
"85299973153307890955417856981051906960",
"226307242843060036528997624511959069074",
"53274284566793401311052899944305208021",
"132187747894849668667927546949813583008",
"48042102095990663579633124559576597176",
"250027166589586235837919589666397541946",
"189263832956223230307344653412425276408",
"242210660184667582233588165440910169893",
"100662739938172441907825461785150408679",
"294590202508494735518993208420900095400"
]
},
"deprecated": false,
"target": {
"file": "system/btif/src/btif_storage.cc"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135",
"signature_version": "v1",
"id": "ASB-A-308429049-3b88339e",
"signature_type": "Function",
"digest": {
"function_hash": "126303277565485501753111772474371276049",
"length": 481.0
},
"deprecated": false,
"target": {
"function": "btif_storage_remove_hid_info",
"file": "system/btif/src/btif_storage.cc"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135",
"signature_version": "v1",
"id": "ASB-A-308429049-4a69dfb0",
"signature_type": "Function",
"digest": {
"function_hash": "42706880006549958219124354250013173518",
"length": 1440.0
},
"deprecated": false,
"target": {
"function": "btif_storage_load_bonded_hid_info",
"file": "system/btif/src/btif_storage.cc"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135",
"signature_version": "v1",
"id": "ASB-A-308429049-6d774929",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"27621552268262761906415181774814752773",
"288801400220938511482805035950765811664",
"133522235847602429083318303090263909763",
"75674075207511412222984202765894364110",
"56073425218409304369752292750480821505",
"237805658623138355820464117613070864614",
"233933501042563994296158370532321252062",
"33873349815548475472221819975890478261",
"35260134336053135574499237109160548283",
"204076722363650750027806484414567108329",
"220592040539762092078080828236597644074",
"274619176600021314191260814763560287361"
]
},
"deprecated": false,
"target": {
"file": "android/app/jni/com_android_bluetooth_hid_host.cpp"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135",
"signature_version": "v1",
"id": "ASB-A-308429049-7259c2e6",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"227899358538409517856067685287876554706",
"245418956962847795723857647108822058318",
"134699755498931838178586688393108862852",
"194865366721406733496048607129864311296"
]
},
"deprecated": false,
"target": {
"file": "system/include/hardware/bt_hh.h"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135",
"signature_version": "v1",
"id": "ASB-A-308429049-7a1ba823",
"signature_type": "Function",
"digest": {
"function_hash": "128763192995420248878177185563205823242",
"length": 1157.0
},
"deprecated": false,
"target": {
"function": "set_info",
"file": "system/btif/src/btif_hh.cc"
}
},
{
"signature_version": "v1",
"match_only_versions": [
"13"
],
"signature_type": "Function",
"digest": {
"function_hash": "277360477204508191796614849911251691523",
"length": 291.0
},
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135",
"id": "ASB-A-308429049-857de4e4",
"deprecated": false,
"target": {
"function": "btif_hh_find_connected_dev_by_handle",
"file": "system/btif/src/btif_hh.cc"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135",
"signature_version": "v1",
"id": "ASB-A-308429049-85f62726",
"signature_type": "Function",
"digest": {
"function_hash": "202640640649144823239925943175922150063",
"length": 731.0
},
"deprecated": false,
"target": {
"function": "btif_hh_add_added_dev",
"file": "system/btif/src/btif_hh.cc"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135",
"signature_version": "v1",
"id": "ASB-A-308429049-91b5c2c7",
"signature_type": "Function",
"digest": {
"function_hash": "273590541221959285919482916848782974788",
"length": 469.0
},
"deprecated": false,
"target": {
"function": "connect",
"file": "system/btif/src/btif_hh.cc"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135",
"signature_version": "v1",
"id": "ASB-A-308429049-a175f8fe",
"signature_type": "Function",
"digest": {
"function_hash": "330802267899331755496730107164326512900",
"length": 4483.0
},
"deprecated": false,
"target": {
"function": "handleMessage",
"file": "android/app/src/com/android/bluetooth/hid/HidHostService.java"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135",
"signature_version": "v1",
"id": "ASB-A-308429049-a4dcab5a",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"65549679613772413678102436640424678441",
"195670386788895767863086564855409215053",
"220884027888050459794073188008898298494",
"253805953097722042992920685316186095067",
"66861155985976005743441882007222848685",
"206919005338448269698087110525071768491",
"86943222077395071290348925957664974502",
"264732599433981155164211743878569962407",
"74949519438168872118660337738286612317",
"170579603804230240805507481346640236021",
"255274708474135515375769745173939989148",
"311347657948341987808512501874828850506",
"67747526815271887257350747450247011315",
"60412223426039716850733350482578328087",
"121381335755702676806537965648534729075",
"126794670683880356243106718395990718435",
"236159479575370349532718946413460713712",
"75604470016503300098032823961778467388",
"235442078797228627295935670522678011255",
"126966896551601924649590864002249194498",
"20601315180127526721814064567972785416",
"62736884502223649804779624694526925676",
"261506016401621619454327286264925386802",
"215152308293940776347979094737172199979",
"270243792665290797813872842387323129470",
"101421510903520573597939511895532694288",
"227704493175366387259205209161021997405",
"226275433423407564242440052198500751403",
"115228673700935846416722653128627656645",
"16980613717017928587496956537503909865",
"216645494787047228888220418121114280877",
"319781981615425090469144052084976438484",
"271280403539996994105555058098210882939",
"252698769636796057654522306923969629834",
"297974517608133392161224480674409181189",
"69313495299650925561712953016339759471",
"37493267760268515402656513306725795260",
"286248700242141192303150367843172448973",
"321922583144823709995136603852227685708",
"205944269063474184113154984858603491890",
"254906363803486652302193052726300344910",
"338443969919162400819717491698236576560",
"83602736468396171686958198237664840479",
"234554694075594247169701766611797496348",
"58506341859848766368300754611113865643",
"283213613291056445830966362418425387166",
"320872826372232431641624168330742320891",
"276455348913963253351598191445887246165",
"169469159469116415061216638804041630938",
"150904272810797641673540097251971060722"
]
},
"deprecated": false,
"target": {
"file": "system/btif/src/btif_hh.cc"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135",
"signature_version": "v1",
"id": "ASB-A-308429049-c36a588b",
"signature_type": "Function",
"digest": {
"function_hash": "279898461299574084119801119262266496361",
"length": 11520.0
},
"deprecated": false,
"target": {
"function": "btif_hh_upstreams_evt",
"file": "system/btif/src/btif_hh.cc"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135",
"signature_version": "v1",
"id": "ASB-A-308429049-eb9d98d2",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"250655852475536386734524265120640904516",
"43769362685686748346162037333905389578",
"114299465192274493908160834881917422921",
"196144582453448189657365252491737249933",
"227573380902516223736440567117326847452",
"308006914869671489122750159631148667892",
"18775829689402249864048040461523698134",
"184061815538032302946340186902821795054"
]
},
"deprecated": false,
"target": {
"file": "system/btif/include/btif_hh.h"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135",
"signature_version": "v1",
"id": "ASB-A-308429049-fa806f77",
"signature_type": "Function",
"digest": {
"function_hash": "219854067603610606879397688283628466064",
"length": 520.0
},
"deprecated": false,
"target": {
"function": "disconnect",
"file": "system/btif/src/btif_hh.cc"
}
}
],
"spl": "2025-01-01"
}{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5"
],
"severity": "High",
"types": [
"EoP"
],
"vanir_signatures": [
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5",
"signature_version": "v1",
"id": "ASB-A-308429049-1bb6a976",
"signature_type": "Function",
"digest": {
"function_hash": "9110497437072575768652158182921314735",
"length": 9844.0
},
"deprecated": false,
"target": {
"function": "btif_hh_upstreams_evt",
"file": "system/btif/src/btif_hh.cc"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5",
"signature_version": "v1",
"id": "ASB-A-308429049-1dfec5d2",
"signature_type": "Function",
"digest": {
"function_hash": "128763192995420248878177185563205823242",
"length": 1157.0
},
"deprecated": false,
"target": {
"function": "set_info",
"file": "system/btif/src/btif_hh.cc"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5",
"signature_version": "v1",
"id": "ASB-A-308429049-292d897d",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"250655852475536386734524265120640904516",
"43769362685686748346162037333905389578",
"114299465192274493908160834881917422921",
"196144582453448189657365252491737249933",
"143442260058731079200931225439028221215",
"245641286850131859026477393101714729569",
"316269312456469870249117477237293025385",
"28551354722956230281230087565096623881"
]
},
"deprecated": false,
"target": {
"file": "system/btif/include/btif_hh.h"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5",
"signature_version": "v1",
"id": "ASB-A-308429049-2a52609c",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"27621552268262761906415181774814752773",
"288801400220938511482805035950765811664",
"133522235847602429083318303090263909763",
"75674075207511412222984202765894364110",
"56073425218409304369752292750480821505",
"237805658623138355820464117613070864614",
"233933501042563994296158370532321252062",
"33873349815548475472221819975890478261",
"35260134336053135574499237109160548283",
"204076722363650750027806484414567108329",
"220592040539762092078080828236597644074",
"274619176600021314191260814763560287361"
]
},
"deprecated": false,
"target": {
"file": "android/app/jni/com_android_bluetooth_hid_host.cpp"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5",
"signature_version": "v1",
"id": "ASB-A-308429049-314c117f",
"signature_type": "Function",
"digest": {
"function_hash": "310937851774680520734783838035214314128",
"length": 1007.0
},
"deprecated": false,
"target": {
"function": "disconnect",
"file": "system/btif/src/btif_hh.cc"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5",
"signature_version": "v1",
"id": "ASB-A-308429049-41d62842",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"303252666331067046513335026039053203559",
"56729228907213895770454249657657622095",
"286918361762158942160248550620733493370",
"269971316717862735904134939574679864071",
"177316505114957210654306769202968855127",
"295353076617967965461711372467695114006",
"53274284566793401311052899944305208021",
"132187747894849668667927546949813583008",
"48042102095990663579633124559576597176",
"250027166589586235837919589666397541946",
"189263832956223230307344653412425276408",
"212924924080464821546403360952563697729",
"185054749562976482235847801569660950482",
"828842139594560943724805831579983429"
]
},
"deprecated": false,
"target": {
"file": "system/btif/src/btif_profile_storage.cc"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5",
"signature_version": "v1",
"id": "ASB-A-308429049-4e83d7f3",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"227899358538409517856067685287876554706",
"245418956962847795723857647108822058318",
"134699755498931838178586688393108862852",
"194865366721406733496048607129864311296"
]
},
"deprecated": false,
"target": {
"file": "system/include/hardware/bt_hh.h"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5",
"signature_version": "v1",
"id": "ASB-A-308429049-4f336470",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"253805953097722042992920685316186095067",
"147632558847293547356282675936582441244",
"35079732222841874192941079477030023329",
"8196735781821500580693915956875173791",
"5538173969274321853511075016074792753",
"50337954822427635958997205690742320950",
"158735486742052297117820723183792867131",
"279418752606131652897106781782224672357",
"278282817125209050105594156823623248835",
"300005675397444438981299580358627357777",
"170579603804230240805507481346640236021",
"255274708474135515375769745173939989148",
"331346352591458952361467667202960179355",
"333240154083123665293264570228427657099",
"314833691586773120991421555909148268779",
"267934517565530636827481084994097441325",
"67747526815271887257350747450247011315",
"60412223426039716850733350482578328087",
"121381335755702676806537965648534729075",
"101421510903520573597939511895532694288",
"227704493175366387259205209161021997405",
"226275433423407564242440052198500751403",
"115228673700935846416722653128627656645",
"16980613717017928587496956537503909865",
"216645494787047228888220418121114280877",
"319781981615425090469144052084976438484",
"58835024864636899566527720382174605410",
"324328679293673742192042151484249698334",
"6206189075387526867035320547263059541",
"168219655546118196037642256994055731044",
"42203491668581517518517766780300302275",
"192257065670910696572802278086270199525",
"238153109688328323866096262244796465990",
"287081263310307503022412731605812495531",
"113500289002673668180123452447822713552",
"47152200575541705714070786409426189787",
"171172625699748995026315221717783390534",
"321922583144823709995136603852227685708",
"205944269063474184113154984858603491890",
"180685689689583731283547999403288921025",
"223921535183438426169717301958922691203",
"3003679761982022417349736298938861911",
"58506341859848766368300754611113865643",
"283213613291056445830966362418425387166",
"320872826372232431641624168330742320891",
"276455348913963253351598191445887246165",
"169469159469116415061216638804041630938",
"150904272810797641673540097251971060722"
]
},
"deprecated": false,
"target": {
"file": "system/btif/src/btif_hh.cc"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5",
"signature_version": "v1",
"id": "ASB-A-308429049-5e934ae6",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"157466916029750674237607646115444320297",
"234654250507842126909569012871429245336",
"181881416923704576084282559136696827352"
]
},
"deprecated": false,
"target": {
"file": "system/btif/include/btif_storage.h"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5",
"signature_version": "v1",
"id": "ASB-A-308429049-5ecf2ef2",
"signature_type": "Function",
"digest": {
"function_hash": "215041838826125737418862833033085942707",
"length": 556.0
},
"deprecated": false,
"target": {
"function": "disconnectHidNative",
"file": "android/app/jni/com_android_bluetooth_hid_host.cpp"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5",
"signature_version": "v1",
"id": "ASB-A-308429049-9531f6ee",
"signature_type": "Function",
"digest": {
"function_hash": "147569357635755919624625547340917758357",
"length": 757.0
},
"deprecated": false,
"target": {
"function": "btif_hh_add_added_dev",
"file": "system/btif/src/btif_hh.cc"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5",
"signature_version": "v1",
"id": "ASB-A-308429049-ca26021b",
"signature_type": "Function",
"digest": {
"function_hash": "155721267969419515505786481469447759805",
"length": 466.0
},
"deprecated": false,
"target": {
"function": "btif_storage_remove_hid_info",
"file": "system/btif/src/btif_profile_storage.cc"
}
},
{
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "89242460328368372892104077634764793122",
"length": 1417.0
},
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5",
"id": "ASB-A-308429049-d01f9794",
"exact_target_file_match_only": true,
"deprecated": false,
"target": {
"function": "hh_open_handler",
"file": "system/btif/src/btif_hh.cc"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5",
"signature_version": "v1",
"id": "ASB-A-308429049-d256eb67",
"signature_type": "Function",
"digest": {
"function_hash": "330802267899331755496730107164326512900",
"length": 4483.0
},
"deprecated": false,
"target": {
"function": "handleMessage",
"file": "android/app/src/com/android/bluetooth/hid/HidHostService.java"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5",
"signature_version": "v1",
"id": "ASB-A-308429049-e546208f",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"108483140622762840761252473352879087736",
"92321261922023850310873916168711306105",
"208512423671106555842603402292705464054",
"29357230793833980083684887722416901494",
"254824077763076210143639989454564472638",
"202732230022212232395905026767210514060",
"117918539907807589536225682384548119120",
"151394948645309531335032097935128175703",
"273657911209795218425148159180696707729",
"108740058939617127469900139319670900885",
"111488344450951130654573380800421075538"
]
},
"deprecated": false,
"target": {
"file": "android/app/src/com/android/bluetooth/hid/HidHostService.java"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5",
"signature_version": "v1",
"id": "ASB-A-308429049-f8d244ea",
"signature_type": "Function",
"digest": {
"function_hash": "73139362088913508149681361803251262940",
"length": 1445.0
},
"deprecated": false,
"target": {
"function": "btif_storage_load_bonded_hid_info",
"file": "system/btif/src/btif_profile_storage.cc"
}
},
{
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5",
"signature_version": "v1",
"id": "ASB-A-308429049-f9b0e078",
"signature_type": "Function",
"digest": {
"function_hash": "313873716040432986787339198001785851781",
"length": 993.0
},
"deprecated": false,
"target": {
"function": "connect",
"file": "system/btif/src/btif_hh.cc"
}
}
],
"spl": "2025-01-01"
}