In build_read_multi_rsp of gatt_sr.cc, there is a possible denial of service due to a logic error in the code. This could lead to remote (proximal/adjacent) denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/24508a81f05dc33e2abda46997445d84c4c76df5"
],
"severity": "High",
"spl": "2025-01-01",
"types": [
"DoS"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "39974884357733382414201187773803691582",
"length": 2156
},
"id": "ASB-A-356886209-9bfab64c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/24508a81f05dc33e2abda46997445d84c4c76df5",
"target": {
"file": "system/stack/gatt/gatt_sr.cc",
"function": "build_read_multi_rsp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"256103936039081068814854393900838184127",
"233910280098665537013382464207360200070",
"83699234729775685097611726235894016936",
"106566999101762116401845614754552683359"
],
"threshold": 0.9
},
"id": "ASB-A-356886209-c45409bc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/24508a81f05dc33e2abda46997445d84c4c76df5",
"target": {
"file": "system/stack/gatt/gatt_sr.cc"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/24508a81f05dc33e2abda46997445d84c4c76df5"
],
"severity": "High",
"spl": "2025-01-01",
"types": [
"DoS"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "39974884357733382414201187773803691582",
"length": 2156
},
"id": "ASB-A-356886209-22f7266c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/24508a81f05dc33e2abda46997445d84c4c76df5",
"target": {
"file": "system/stack/gatt/gatt_sr.cc",
"function": "build_read_multi_rsp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"256103936039081068814854393900838184127",
"233910280098665537013382464207360200070",
"83699234729775685097611726235894016936",
"106566999101762116401845614754552683359"
],
"threshold": 0.9
},
"id": "ASB-A-356886209-34113492",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/24508a81f05dc33e2abda46997445d84c4c76df5",
"target": {
"file": "system/stack/gatt/gatt_sr.cc"
}
}
]
}