ASB-A-455566331

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-455566331.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-455566331
Aliases
  • A-455566331
  • CVE-2026-28627
Published
2026-09-01T00:00:00Z
Modified
2026-09-08T15:39:03Z
Summary
[none]
Details

In btm_sec_encrypt_change of btm_sec.cc, there is a possible downgrade attack due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/packages/modules/Bluetooth

Package

Name
platform/packages/modules/Bluetooth

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-09-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/13872784a01e3d244ef955465515187c42bf293d",
        "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b3a91968ea3b4a057d354ef40ede6fbf212a7c8e"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "ID"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "205822490183520084071808805550573095980",
                "length": 6807
            },
            "id": "ASB-A-455566331-22f85846",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b3a91968ea3b4a057d354ef40ede6fbf212a7c8e",
            "target": {
                "file": "system/stack/btm/btm_sec.cc",
                "function": "btm_sec_encrypt_change"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "266911383651849706627189516025474655044",
                    "22746015159294279785369247517525573417",
                    "16822600875316432780509451369327459240",
                    "69506406385031247304147542052227090042",
                    "234778014219492089925774012715693957129"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-455566331-3d315cb2",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b3a91968ea3b4a057d354ef40ede6fbf212a7c8e",
            "target": {
                "file": "system/stack/btm/btm_sec.cc"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "246751366734274379694686193180412433198",
                "length": 6571
            },
            "id": "ASB-A-455566331-ca99018e",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/13872784a01e3d244ef955465515187c42bf293d",
            "target": {
                "file": "system/stack/btm/btm_sec.cc",
                "function": "btm_sec_encrypt_change"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "256691374848977035078864017690569886985",
                    "179598493196210115821858848815657945457",
                    "195880702532091725239692041728703023238",
                    "229929706873943957283950205701308384880"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-455566331-e58bc75c",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/13872784a01e3d244ef955465515187c42bf293d",
            "target": {
                "file": "system/stack/btm/btm_sec.cc"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-455566331.json"
platform/packages/modules/Bluetooth

Package

Name
platform/packages/modules/Bluetooth

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-09-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/75e12a42313fe94a8e53ed9a35eecfbb0144cb0e"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "ID"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "48621335918798919918337838781628094397",
                    "315922361224175920817306337553823066528",
                    "58505352865503788653323961472191447681",
                    "241788827861155263427171009912068500749",
                    "5083288000807364608694487327912323228",
                    "231136603987698915759560593421910865940"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-455566331-b0a3f646",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/75e12a42313fe94a8e53ed9a35eecfbb0144cb0e",
            "target": {
                "file": "system/stack/btm/btm_sec_utils.cc"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "311209934801716296561149952539486379434",
                "length": 6070
            },
            "id": "ASB-A-455566331-d298bb19",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/75e12a42313fe94a8e53ed9a35eecfbb0144cb0e",
            "target": {
                "file": "system/stack/btm/btm_sec.cc",
                "function": "btm_sec_encrypt_change"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "73604516503037035217799911193538492959",
                    "13432903150882513040862906307534883967",
                    "113106014658141633640494704114389900491",
                    "94887924795509970787836457779110026018"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-455566331-e8cc0977",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/75e12a42313fe94a8e53ed9a35eecfbb0144cb0e",
            "target": {
                "file": "system/stack/btm/btm_sec.cc"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "196905764144984863732894774175353669607",
                "length": 732
            },
            "id": "ASB-A-455566331-fc2ca36b",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/75e12a42313fe94a8e53ed9a35eecfbb0144cb0e",
            "target": {
                "file": "system/stack/btm/btm_sec_utils.cc",
                "function": "btm_sec_is_enc_algo_downgrade"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-455566331.json"
platform/packages/modules/Bluetooth

Package

Name
platform/packages/modules/Bluetooth

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-09-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f531858aba8cbcc1c502f1efb77247d0bcf69d45"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "ID"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "246751366734274379694686193180412433198",
                "length": 6571
            },
            "id": "ASB-A-455566331-9fe2bdfa",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f531858aba8cbcc1c502f1efb77247d0bcf69d45",
            "target": {
                "file": "system/stack/btm/btm_sec.cc",
                "function": "btm_sec_encrypt_change"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "256691374848977035078864017690569886985",
                    "179598493196210115821858848815657945457",
                    "195880702532091725239692041728703023238",
                    "229929706873943957283950205701308384880"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-455566331-f5d9d990",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f531858aba8cbcc1c502f1efb77247d0bcf69d45",
            "target": {
                "file": "system/stack/btm/btm_sec.cc"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-455566331.json"