In multiple locations, there is a possible bypass of user consent to enabling new Bluetooth HIDs due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "225248484501167241263529534673073971315", "72029136021544760177668659079629039595", "181881416923704576084282559136696827352" ] }, "id": "ASB-A-308429049-018b943a", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135", "deprecated": false, "signature_version": "v1", "target": { "file": "system/btif/include/btif_storage.h" }, "signature_type": "Line" }, { "digest": { "threshold": 0.9, "line_hashes": [ "108483140622762840761252473352879087736", "92321261922023850310873916168711306105", "208512423671106555842603402292705464054", "29357230793833980083684887722416901494", "151394948645309531335032097935128175703", "273657911209795218425148159180696707729", "108740058939617127469900139319670900885", "111488344450951130654573380800421075538" ] }, "id": "ASB-A-308429049-053f8b2d", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135", "deprecated": false, "signature_version": "v1", "target": { "file": "android/app/src/com/android/bluetooth/hid/HidHostService.java" }, "signature_type": "Line" }, { "digest": { "length": 556.0, "function_hash": "215041838826125737418862833033085942707" }, "id": "ASB-A-308429049-078a2430", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135", "deprecated": false, "signature_version": "v1", "target": { "file": "android/app/jni/com_android_bluetooth_hid_host.cpp", "function": "disconnectHidNative" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "26991000918010011293032425820194375858", "189540976721447778448066271083184349028", "114953138903427366747704093442747913243", "11210350231520943643999824683593482146", "85299973153307890955417856981051906960", "226307242843060036528997624511959069074", "53274284566793401311052899944305208021", "132187747894849668667927546949813583008", "48042102095990663579633124559576597176", "250027166589586235837919589666397541946", "189263832956223230307344653412425276408", "242210660184667582233588165440910169893", "100662739938172441907825461785150408679", "294590202508494735518993208420900095400" ] }, "id": "ASB-A-308429049-09ad8b4b", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135", "deprecated": false, "signature_version": "v1", "target": { "file": "system/btif/src/btif_storage.cc" }, "signature_type": "Line" }, { "digest": { "length": 481.0, "function_hash": "126303277565485501753111772474371276049" }, "id": "ASB-A-308429049-3b88339e", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135", "deprecated": false, "signature_version": "v1", "target": { "file": "system/btif/src/btif_storage.cc", "function": "btif_storage_remove_hid_info" }, "signature_type": "Function" }, { "digest": { "length": 1440.0, "function_hash": "42706880006549958219124354250013173518" }, "id": "ASB-A-308429049-4a69dfb0", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135", "deprecated": false, "signature_version": "v1", "target": { "file": "system/btif/src/btif_storage.cc", "function": "btif_storage_load_bonded_hid_info" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "27621552268262761906415181774814752773", "288801400220938511482805035950765811664", "133522235847602429083318303090263909763", "75674075207511412222984202765894364110", "56073425218409304369752292750480821505", "237805658623138355820464117613070864614", "233933501042563994296158370532321252062", "33873349815548475472221819975890478261", "35260134336053135574499237109160548283", "204076722363650750027806484414567108329", "220592040539762092078080828236597644074", "274619176600021314191260814763560287361" ] }, "id": "ASB-A-308429049-6d774929", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135", "deprecated": false, "signature_version": "v1", "target": { "file": "android/app/jni/com_android_bluetooth_hid_host.cpp" }, "signature_type": "Line" }, { "digest": { "threshold": 0.9, "line_hashes": [ "227899358538409517856067685287876554706", "245418956962847795723857647108822058318", "134699755498931838178586688393108862852", "194865366721406733496048607129864311296" ] }, "id": "ASB-A-308429049-7259c2e6", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135", "deprecated": false, "signature_version": "v1", "target": { "file": "system/include/hardware/bt_hh.h" }, "signature_type": "Line" }, { "digest": { "length": 1157.0, "function_hash": "128763192995420248878177185563205823242" }, "id": "ASB-A-308429049-7a1ba823", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135", "deprecated": false, "signature_version": "v1", "target": { "file": "system/btif/src/btif_hh.cc", "function": "set_info" }, "signature_type": "Function" }, { "match_only_versions": [ "13" ], "digest": { "length": 291.0, "function_hash": "277360477204508191796614849911251691523" }, "id": "ASB-A-308429049-857de4e4", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135", "deprecated": false, "signature_version": "v1", "target": { "file": "system/btif/src/btif_hh.cc", "function": "btif_hh_find_connected_dev_by_handle" }, "signature_type": "Function" }, { "digest": { "length": 731.0, "function_hash": "202640640649144823239925943175922150063" }, "id": "ASB-A-308429049-85f62726", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135", "deprecated": false, "signature_version": "v1", "target": { "file": "system/btif/src/btif_hh.cc", "function": "btif_hh_add_added_dev" }, "signature_type": "Function" }, { "digest": { "length": 469.0, "function_hash": "273590541221959285919482916848782974788" }, "id": "ASB-A-308429049-91b5c2c7", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135", "deprecated": false, "signature_version": "v1", "target": { "file": "system/btif/src/btif_hh.cc", "function": "connect" }, "signature_type": "Function" }, { "digest": { "length": 4483.0, "function_hash": "330802267899331755496730107164326512900" }, "id": "ASB-A-308429049-a175f8fe", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135", "deprecated": false, "signature_version": "v1", "target": { "file": "android/app/src/com/android/bluetooth/hid/HidHostService.java", "function": "handleMessage" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "65549679613772413678102436640424678441", "195670386788895767863086564855409215053", "220884027888050459794073188008898298494", "253805953097722042992920685316186095067", "66861155985976005743441882007222848685", "206919005338448269698087110525071768491", "86943222077395071290348925957664974502", "264732599433981155164211743878569962407", "74949519438168872118660337738286612317", "170579603804230240805507481346640236021", "255274708474135515375769745173939989148", "311347657948341987808512501874828850506", "67747526815271887257350747450247011315", "60412223426039716850733350482578328087", "121381335755702676806537965648534729075", "126794670683880356243106718395990718435", "236159479575370349532718946413460713712", "75604470016503300098032823961778467388", "235442078797228627295935670522678011255", "126966896551601924649590864002249194498", "20601315180127526721814064567972785416", "62736884502223649804779624694526925676", "261506016401621619454327286264925386802", "215152308293940776347979094737172199979", "270243792665290797813872842387323129470", "101421510903520573597939511895532694288", "227704493175366387259205209161021997405", "226275433423407564242440052198500751403", "115228673700935846416722653128627656645", "16980613717017928587496956537503909865", "216645494787047228888220418121114280877", "319781981615425090469144052084976438484", "271280403539996994105555058098210882939", "252698769636796057654522306923969629834", "297974517608133392161224480674409181189", "69313495299650925561712953016339759471", "37493267760268515402656513306725795260", "286248700242141192303150367843172448973", "321922583144823709995136603852227685708", "205944269063474184113154984858603491890", "254906363803486652302193052726300344910", "338443969919162400819717491698236576560", "83602736468396171686958198237664840479", "234554694075594247169701766611797496348", "58506341859848766368300754611113865643", "283213613291056445830966362418425387166", "320872826372232431641624168330742320891", "276455348913963253351598191445887246165", "169469159469116415061216638804041630938", "150904272810797641673540097251971060722" ] }, "id": "ASB-A-308429049-a4dcab5a", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135", "deprecated": false, "signature_version": "v1", "target": { "file": "system/btif/src/btif_hh.cc" }, "signature_type": "Line" }, { "digest": { "length": 11520.0, "function_hash": "279898461299574084119801119262266496361" }, "id": "ASB-A-308429049-c36a588b", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135", "deprecated": false, "signature_version": "v1", "target": { "file": "system/btif/src/btif_hh.cc", "function": "btif_hh_upstreams_evt" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "250655852475536386734524265120640904516", "43769362685686748346162037333905389578", "114299465192274493908160834881917422921", "196144582453448189657365252491737249933", "227573380902516223736440567117326847452", "308006914869671489122750159631148667892", "18775829689402249864048040461523698134", "184061815538032302946340186902821795054" ] }, "id": "ASB-A-308429049-eb9d98d2", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135", "deprecated": false, "signature_version": "v1", "target": { "file": "system/btif/include/btif_hh.h" }, "signature_type": "Line" }, { "digest": { "length": 520.0, "function_hash": "219854067603610606879397688283628466064" }, "id": "ASB-A-308429049-fa806f77", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135", "deprecated": false, "signature_version": "v1", "target": { "file": "system/btif/src/btif_hh.cc", "function": "disconnect" }, "signature_type": "Function" } ], "fixes": [ "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/03dca3305311096f157da3ab9cfed5cc30f2c135" ], "spl": "2025-01-01", "severity": "High", "types": [ "EoP" ] }
{ "vanir_signatures": [ { "digest": { "length": 9844.0, "function_hash": "9110497437072575768652158182921314735" }, "id": "ASB-A-308429049-1bb6a976", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5", "deprecated": false, "signature_version": "v1", "target": { "file": "system/btif/src/btif_hh.cc", "function": "btif_hh_upstreams_evt" }, "signature_type": "Function" }, { "digest": { "length": 1157.0, "function_hash": "128763192995420248878177185563205823242" }, "id": "ASB-A-308429049-1dfec5d2", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5", "deprecated": false, "signature_version": "v1", "target": { "file": "system/btif/src/btif_hh.cc", "function": "set_info" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "250655852475536386734524265120640904516", "43769362685686748346162037333905389578", "114299465192274493908160834881917422921", "196144582453448189657365252491737249933", "143442260058731079200931225439028221215", "245641286850131859026477393101714729569", "316269312456469870249117477237293025385", "28551354722956230281230087565096623881" ] }, "id": "ASB-A-308429049-292d897d", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5", "deprecated": false, "signature_version": "v1", "target": { "file": "system/btif/include/btif_hh.h" }, "signature_type": "Line" }, { "digest": { "threshold": 0.9, "line_hashes": [ "27621552268262761906415181774814752773", "288801400220938511482805035950765811664", "133522235847602429083318303090263909763", "75674075207511412222984202765894364110", "56073425218409304369752292750480821505", "237805658623138355820464117613070864614", "233933501042563994296158370532321252062", "33873349815548475472221819975890478261", "35260134336053135574499237109160548283", "204076722363650750027806484414567108329", "220592040539762092078080828236597644074", "274619176600021314191260814763560287361" ] }, "id": "ASB-A-308429049-2a52609c", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5", "deprecated": false, "signature_version": "v1", "target": { "file": "android/app/jni/com_android_bluetooth_hid_host.cpp" }, "signature_type": "Line" }, { "digest": { "length": 1007.0, "function_hash": "310937851774680520734783838035214314128" }, "id": "ASB-A-308429049-314c117f", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5", "deprecated": false, "signature_version": "v1", "target": { "file": "system/btif/src/btif_hh.cc", "function": "disconnect" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "303252666331067046513335026039053203559", "56729228907213895770454249657657622095", "286918361762158942160248550620733493370", "269971316717862735904134939574679864071", "177316505114957210654306769202968855127", "295353076617967965461711372467695114006", "53274284566793401311052899944305208021", "132187747894849668667927546949813583008", "48042102095990663579633124559576597176", "250027166589586235837919589666397541946", "189263832956223230307344653412425276408", "212924924080464821546403360952563697729", "185054749562976482235847801569660950482", "828842139594560943724805831579983429" ] }, "id": "ASB-A-308429049-41d62842", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5", "deprecated": false, "signature_version": "v1", "target": { "file": "system/btif/src/btif_profile_storage.cc" }, "signature_type": "Line" }, { "digest": { "threshold": 0.9, "line_hashes": [ "227899358538409517856067685287876554706", "245418956962847795723857647108822058318", "134699755498931838178586688393108862852", "194865366721406733496048607129864311296" ] }, "id": "ASB-A-308429049-4e83d7f3", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5", "deprecated": false, "signature_version": "v1", "target": { "file": "system/include/hardware/bt_hh.h" }, "signature_type": "Line" }, { "digest": { "threshold": 0.9, "line_hashes": [ "253805953097722042992920685316186095067", "147632558847293547356282675936582441244", "35079732222841874192941079477030023329", "8196735781821500580693915956875173791", "5538173969274321853511075016074792753", "50337954822427635958997205690742320950", "158735486742052297117820723183792867131", "279418752606131652897106781782224672357", "278282817125209050105594156823623248835", "300005675397444438981299580358627357777", "170579603804230240805507481346640236021", "255274708474135515375769745173939989148", "331346352591458952361467667202960179355", "333240154083123665293264570228427657099", "314833691586773120991421555909148268779", "267934517565530636827481084994097441325", "67747526815271887257350747450247011315", "60412223426039716850733350482578328087", "121381335755702676806537965648534729075", "101421510903520573597939511895532694288", "227704493175366387259205209161021997405", "226275433423407564242440052198500751403", "115228673700935846416722653128627656645", "16980613717017928587496956537503909865", "216645494787047228888220418121114280877", "319781981615425090469144052084976438484", "58835024864636899566527720382174605410", "324328679293673742192042151484249698334", "6206189075387526867035320547263059541", "168219655546118196037642256994055731044", "42203491668581517518517766780300302275", "192257065670910696572802278086270199525", "238153109688328323866096262244796465990", "287081263310307503022412731605812495531", "113500289002673668180123452447822713552", "47152200575541705714070786409426189787", "171172625699748995026315221717783390534", "321922583144823709995136603852227685708", "205944269063474184113154984858603491890", "180685689689583731283547999403288921025", "223921535183438426169717301958922691203", "3003679761982022417349736298938861911", "58506341859848766368300754611113865643", "283213613291056445830966362418425387166", "320872826372232431641624168330742320891", "276455348913963253351598191445887246165", "169469159469116415061216638804041630938", "150904272810797641673540097251971060722" ] }, "id": "ASB-A-308429049-4f336470", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5", "deprecated": false, "signature_version": "v1", "target": { "file": "system/btif/src/btif_hh.cc" }, "signature_type": "Line" }, { "digest": { "threshold": 0.9, "line_hashes": [ "157466916029750674237607646115444320297", "234654250507842126909569012871429245336", "181881416923704576084282559136696827352" ] }, "id": "ASB-A-308429049-5e934ae6", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5", "deprecated": false, "signature_version": "v1", "target": { "file": "system/btif/include/btif_storage.h" }, "signature_type": "Line" }, { "digest": { "length": 556.0, "function_hash": "215041838826125737418862833033085942707" }, "id": "ASB-A-308429049-5ecf2ef2", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5", "deprecated": false, "signature_version": "v1", "target": { "file": "android/app/jni/com_android_bluetooth_hid_host.cpp", "function": "disconnectHidNative" }, "signature_type": "Function" }, { "digest": { "length": 757.0, "function_hash": "147569357635755919624625547340917758357" }, "id": "ASB-A-308429049-9531f6ee", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5", "deprecated": false, "signature_version": "v1", "target": { "file": "system/btif/src/btif_hh.cc", "function": "btif_hh_add_added_dev" }, "signature_type": "Function" }, { "digest": { "length": 466.0, "function_hash": "155721267969419515505786481469447759805" }, "id": "ASB-A-308429049-ca26021b", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5", "deprecated": false, "signature_version": "v1", "target": { "file": "system/btif/src/btif_profile_storage.cc", "function": "btif_storage_remove_hid_info" }, "signature_type": "Function" }, { "digest": { "length": 1417.0, "function_hash": "89242460328368372892104077634764793122" }, "id": "ASB-A-308429049-d01f9794", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5", "deprecated": false, "signature_version": "v1", "target": { "file": "system/btif/src/btif_hh.cc", "function": "hh_open_handler" }, "signature_type": "Function" }, { "digest": { "length": 4483.0, "function_hash": "330802267899331755496730107164326512900" }, "id": "ASB-A-308429049-d256eb67", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5", "deprecated": false, "signature_version": "v1", "target": { "file": "android/app/src/com/android/bluetooth/hid/HidHostService.java", "function": "handleMessage" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "108483140622762840761252473352879087736", "92321261922023850310873916168711306105", "208512423671106555842603402292705464054", "29357230793833980083684887722416901494", "254824077763076210143639989454564472638", "202732230022212232395905026767210514060", "117918539907807589536225682384548119120", "151394948645309531335032097935128175703", "273657911209795218425148159180696707729", "108740058939617127469900139319670900885", "111488344450951130654573380800421075538" ] }, "id": "ASB-A-308429049-e546208f", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5", "deprecated": false, "signature_version": "v1", "target": { "file": "android/app/src/com/android/bluetooth/hid/HidHostService.java" }, "signature_type": "Line" }, { "digest": { "length": 1445.0, "function_hash": "73139362088913508149681361803251262940" }, "id": "ASB-A-308429049-f8d244ea", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5", "deprecated": false, "signature_version": "v1", "target": { "file": "system/btif/src/btif_profile_storage.cc", "function": "btif_storage_load_bonded_hid_info" }, "signature_type": "Function" }, { "digest": { "length": 993.0, "function_hash": "313873716040432986787339198001785851781" }, "id": "ASB-A-308429049-f9b0e078", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5", "deprecated": false, "signature_version": "v1", "target": { "file": "system/btif/src/btif_hh.cc", "function": "connect" }, "signature_type": "Function" } ], "fixes": [ "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bdd92020a9c14c3f541b39624c5b1e0af599acc5" ], "spl": "2025-01-01", "severity": "High", "types": [ "EoP" ] }