In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e"
],
"severity": "Critical",
"spl": "2026-10-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "246723683549866751493573909455343009703",
"length": 2214
},
"id": "ASB-A-522372274-019cf37e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e",
"target": {
"file": "system/gd/hal/snoop_logger_test.cc",
"function": "TEST_F"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"158200819445386134177936295702955735382",
"4139362980451998596924249030445462413",
"52700284085879716159314448886049812034",
"278176551384158374446664208198490782019",
"227727791413726504713210430863008135539",
"284360508867883407336331986827730315741",
"88834029904996324001096239099578427898",
"92705279026477912090603448568298029500",
"61980072477478349696857769595441058214",
"276457531786224781861024550526524829516",
"88834029904996324001096239099578427898",
"92705279026477912090603448568298029500",
"142383761567626123287593292611143670631",
"291546764864324326499317700349615109177",
"88834029904996324001096239099578427898",
"92705279026477912090603448568298029500"
],
"threshold": 0.9
},
"id": "ASB-A-522372274-693d31b8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e",
"target": {
"file": "system/gd/hal/snoop_logger_test.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "53881474740965101877136389325477858565",
"length": 2368
},
"id": "ASB-A-522372274-76fbf901",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e",
"target": {
"file": "system/gd/hal/snoop_logger_test.cc",
"function": "TEST_F"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"181266181211620693404888341813178027143",
"111315914176387887908060969285383578850",
"67711727113733261755631088289278506561",
"287227742371283328038254616982367975574",
"110032217682972160027158316572292798414",
"68986527579664712575049020536452280705",
"165560519134704901613096702864142530379",
"31726614903768848027254149897412693371"
],
"threshold": 0.9
},
"id": "ASB-A-522372274-dd83c4cd",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e",
"target": {
"file": "system/gd/hal/snoop_logger.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "154785654276675420321081737784626453063",
"length": 1169
},
"id": "ASB-A-522372274-e6817602",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e",
"target": {
"file": "system/gd/hal/snoop_logger.cc",
"function": "SnoopLogger::FilterCapturedPacket"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "70655787517642236018642036569526023589",
"length": 2308
},
"id": "ASB-A-522372274-e7840df4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e",
"target": {
"file": "system/gd/hal/snoop_logger_test.cc",
"function": "TEST_F"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0e7667da9b935ceb7dd627d2b9b67d7b9bd1bbf2"
],
"severity": "Critical",
"spl": "2026-10-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"158200819445386134177936295702955735382",
"159340739937812780364119428540289608176",
"143616464578955397402840977931471802203",
"270051686240950753391803267439821806406",
"243856159923083137177934890444295057046",
"37477872440081306302429574114126351682",
"10906170983236239424446484760233750396",
"128338104743417124645645249388208906869",
"96790392763558237854259834734548278251",
"253104428708453886646675825165333747950",
"10906170983236239424446484760233750396",
"128338104743417124645645249388208906869",
"41222755738157882998136448067610047202",
"66912489947180533097094676553911762320",
"10906170983236239424446484760233750396",
"128338104743417124645645249388208906869"
],
"threshold": 0.9
},
"id": "ASB-A-522372274-0b4cd1de",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0e7667da9b935ceb7dd627d2b9b67d7b9bd1bbf2",
"target": {
"file": "system/gd/hal/snoop_logger_test.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"181266181211620693404888341813178027143",
"111315914176387887908060969285383578850",
"67711727113733261755631088289278506561",
"287227742371283328038254616982367975574",
"110032217682972160027158316572292798414",
"68986527579664712575049020536452280705",
"165560519134704901613096702864142530379",
"218934215270707795717059640916324652136"
],
"threshold": 0.9
},
"id": "ASB-A-522372274-297fc37d",
"match_only_versions": [
"16"
],
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0e7667da9b935ceb7dd627d2b9b67d7b9bd1bbf2",
"target": {
"file": "system/gd/hal/snoop_logger.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "272561556308199201574688824678322626068",
"length": 2356
},
"id": "ASB-A-522372274-496dac9c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0e7667da9b935ceb7dd627d2b9b67d7b9bd1bbf2",
"target": {
"file": "system/gd/hal/snoop_logger_test.cc",
"function": "TEST_F"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "56353602535859068876142244014369506990",
"length": 2206
},
"id": "ASB-A-522372274-64f56a04",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0e7667da9b935ceb7dd627d2b9b67d7b9bd1bbf2",
"target": {
"file": "system/gd/hal/snoop_logger_test.cc",
"function": "TEST_F"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "154785654276675420321081737784626453063",
"length": 1169
},
"id": "ASB-A-522372274-86e0d577",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0e7667da9b935ceb7dd627d2b9b67d7b9bd1bbf2",
"target": {
"file": "system/gd/hal/snoop_logger.cc",
"function": "SnoopLogger::FilterCapturedPacket"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "95097682103312222007963273808788505444",
"length": 2296
},
"id": "ASB-A-522372274-d86876a5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0e7667da9b935ceb7dd627d2b9b67d7b9bd1bbf2",
"target": {
"file": "system/gd/hal/snoop_logger_test.cc",
"function": "TEST_F"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/be1aa028f47192694e524ad4370d169b2d77e40f"
],
"severity": "Critical",
"spl": "2026-10-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "324712479278546019856595874635751708652",
"length": 2339
},
"id": "ASB-A-522372274-00f918c2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/be1aa028f47192694e524ad4370d169b2d77e40f",
"target": {
"file": "system/gd/hal/snoop_logger_test.cc",
"function": "TEST_P"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"181266181211620693404888341813178027143",
"111315914176387887908060969285383578850",
"67711727113733261755631088289278506561",
"287227742371283328038254616982367975574",
"110032217682972160027158316572292798414",
"68986527579664712575049020536452280705",
"165560519134704901613096702864142530379",
"218934215270707795717059640916324652136"
],
"threshold": 0.9
},
"id": "ASB-A-522372274-33921bde",
"match_only_versions": [
"16-qpr2"
],
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/be1aa028f47192694e524ad4370d169b2d77e40f",
"target": {
"file": "system/gd/hal/snoop_logger.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "67988436774633188839018039484509107849",
"length": 2279
},
"id": "ASB-A-522372274-35171c01",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/be1aa028f47192694e524ad4370d169b2d77e40f",
"target": {
"file": "system/gd/hal/snoop_logger_test.cc",
"function": "TEST_P"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "139365611964801789489041589329465866357",
"length": 2185
},
"id": "ASB-A-522372274-73321647",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/be1aa028f47192694e524ad4370d169b2d77e40f",
"target": {
"file": "system/gd/hal/snoop_logger_test.cc",
"function": "TEST_P"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "154785654276675420321081737784626453063",
"length": 1169
},
"id": "ASB-A-522372274-73d6e2c1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/be1aa028f47192694e524ad4370d169b2d77e40f",
"target": {
"file": "system/gd/hal/snoop_logger.cc",
"function": "SnoopLogger::FilterCapturedPacket"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"158200819445386134177936295702955735382",
"159340739937812780364119428540289608176",
"226320844949627900547404198377861839510",
"137224853085218192034372402784443378162",
"144859298578910593299839899813533889769",
"275683301262758940741517646966636469166",
"115685458349649471316638526311136713507",
"135851685212389741440220350346353913076",
"134057159010788262199221789100292437519",
"121015403339208641216625176641607250510",
"115685458349649471316638526311136713507",
"135851685212389741440220350346353913076",
"34460787386938890624601772986775870578",
"261158253999439962320839955450714563160",
"115685458349649471316638526311136713507",
"135851685212389741440220350346353913076"
],
"threshold": 0.9
},
"id": "ASB-A-522372274-b3c35770",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/be1aa028f47192694e524ad4370d169b2d77e40f",
"target": {
"file": "system/gd/hal/snoop_logger_test.cc"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e97eb2859df35b4d9f99f8bddf490849a5883405"
],
"severity": "Critical",
"spl": "2026-10-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "324712479278546019856595874635751708652",
"length": 2339
},
"id": "ASB-A-522372274-50e64505",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e97eb2859df35b4d9f99f8bddf490849a5883405",
"target": {
"file": "system/gd/hal/snoop_logger_test.cc",
"function": "TEST_F"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"158200819445386134177936295702955735382",
"159340739937812780364119428540289608176",
"324084327174832942660876930286649249108",
"144720227613865487604087824177827442292",
"144859298578910593299839899813533889769",
"275683301262758940741517646966636469166",
"115685458349649471316638526311136713507",
"135851685212389741440220350346353913076",
"134057159010788262199221789100292437519",
"121015403339208641216625176641607250510",
"115685458349649471316638526311136713507",
"135851685212389741440220350346353913076",
"34460787386938890624601772986775870578",
"261158253999439962320839955450714563160",
"115685458349649471316638526311136713507",
"135851685212389741440220350346353913076"
],
"threshold": 0.9
},
"id": "ASB-A-522372274-7245b09b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e97eb2859df35b4d9f99f8bddf490849a5883405",
"target": {
"file": "system/gd/hal/snoop_logger_test.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "139365611964801789489041589329465866357",
"length": 2185
},
"id": "ASB-A-522372274-8976281c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e97eb2859df35b4d9f99f8bddf490849a5883405",
"target": {
"file": "system/gd/hal/snoop_logger_test.cc",
"function": "TEST_F"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "67988436774633188839018039484509107849",
"length": 2279
},
"id": "ASB-A-522372274-a253c174",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e97eb2859df35b4d9f99f8bddf490849a5883405",
"target": {
"file": "system/gd/hal/snoop_logger_test.cc",
"function": "TEST_F"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "154785654276675420321081737784626453063",
"length": 1169
},
"id": "ASB-A-522372274-b5704b9d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e97eb2859df35b4d9f99f8bddf490849a5883405",
"target": {
"file": "system/gd/hal/snoop_logger.cc",
"function": "SnoopLogger::FilterCapturedPacket"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"181266181211620693404888341813178027143",
"111315914176387887908060969285383578850",
"67711727113733261755631088289278506561",
"287227742371283328038254616982367975574",
"110032217682972160027158316572292798414",
"68986527579664712575049020536452280705",
"165560519134704901613096702864142530379",
"218934215270707795717059640916324652136"
],
"threshold": 0.9
},
"id": "ASB-A-522372274-e89df3e3",
"match_only_versions": [
"17"
],
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e97eb2859df35b4d9f99f8bddf490849a5883405",
"target": {
"file": "system/gd/hal/snoop_logger.cc"
}
}
]
}