ASB-A-375409435

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-375409435.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-375409435
Aliases
Published
2025-03-01T00:00:00Z
Modified
2026-04-17T15:55:28.020024Z
Summary
[none]
Details

In sdpsndservicesearchreq of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/packages/modules/Bluetooth

Package

Name
platform/packages/modules/Bluetooth

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15-next:0
Fixed
15-next:2025-03-01

Affected versions

Other
15-next

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "185486579480985713112082667811722275236",
                    "17057568583745171272579259696309426503",
                    "80774933675077869032302284458860655476",
                    "115680520510039957212659840251882548952",
                    "149272764073703809669421546090731542086",
                    "132375438198367819111153161607144242575",
                    "186177419848916491106430461256472221809",
                    "250022138064522366207171179373555795389"
                ]
            },
            "id": "ASB-A-375409435-44e33881",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/7f74d44cebf1cad4b3d7aa9b05236a41cb221e9e",
            "target": {
                "file": "system/stack/sdp/sdp_discovery.cc"
            }
        },
        {
            "digest": {
                "length": 1497.0,
                "function_hash": "140146735426474515366070883419062745255"
            },
            "id": "ASB-A-375409435-47499204",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/7f74d44cebf1cad4b3d7aa9b05236a41cb221e9e",
            "target": {
                "function": "sdp_snd_service_search_req",
                "file": "system/stack/sdp/sdp_discovery.cc"
            }
        },
        {
            "digest": {
                "length": 3689.0,
                "function_hash": "308941742199032283269529400827602332500"
            },
            "id": "ASB-A-375409435-8c0a16e4",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/7f74d44cebf1cad4b3d7aa9b05236a41cb221e9e",
            "target": {
                "function": "process_service_search_attr_rsp",
                "file": "system/stack/sdp/sdp_discovery.cc"
            }
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/7f74d44cebf1cad4b3d7aa9b05236a41cb221e9e"
    ],
    "types": [
        "RCE"
    ],
    "spl": "2025-03-01",
    "severity": "Critical"
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-375409435.json"

Android / platform/packages/modules/Bluetooth

Package

Name
platform/packages/modules/Bluetooth

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2025-03-01

Affected versions

Other
15

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "digest": {
                "length": 1358.0,
                "function_hash": "165027032574402723718083216113014457432"
            },
            "id": "ASB-A-375409435-0c8b0075",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bb2f54f9ed938267c2830da4a9d984529274d8a8",
            "target": {
                "function": "sdp_snd_service_search_req",
                "file": "system/stack/sdp/sdp_discovery.cc"
            }
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "12190546748810153671323829287973396926",
                    "250063306120409055104865957682659589968",
                    "14738994624663035747041608733386582070",
                    "23271983830575734844306478053192221507",
                    "72564316092330557065769555111629989985",
                    "167288907091122585214705296993377740906",
                    "320217447774151956406964022062422034648",
                    "307622193380667158305078197192178528596"
                ]
            },
            "id": "ASB-A-375409435-839ef8ed",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bb2f54f9ed938267c2830da4a9d984529274d8a8",
            "target": {
                "file": "system/stack/sdp/sdp_discovery.cc"
            }
        },
        {
            "digest": {
                "length": 3316.0,
                "function_hash": "48886429007938031076324531841910728667"
            },
            "id": "ASB-A-375409435-ea7c07d0",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bb2f54f9ed938267c2830da4a9d984529274d8a8",
            "target": {
                "function": "process_service_search_attr_rsp",
                "file": "system/stack/sdp/sdp_discovery.cc"
            }
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bb2f54f9ed938267c2830da4a9d984529274d8a8"
    ],
    "types": [
        "RCE"
    ],
    "spl": "2025-03-01",
    "severity": "Critical"
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-375409435.json"