In sdpufindmostspecificserviceuuid of sdputils.cc, there is a possible way to crash Bluetooth due to a missing null check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.
{
"spl": "2022-12-01",
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f98ddca48c98e78ba2720ab25c43d02c87a5027"
],
"types": [
"DoS"
],
"vanir_signatures": [
{
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 1068.0,
"function_hash": "238553091056856029825788990913744794482"
},
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f98ddca48c98e78ba2720ab25c43d02c87a5027",
"target": {
"function": "sdpu_find_most_specific_service_uuid",
"file": "system/stack/sdp/sdp_utils.cc"
},
"id": "PUB-A-227203684-401e6b3b"
},
{
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"160116732034253777826207962760279679938",
"18908339239817071240172786701048238448",
"297454108314900748288197999731715647218",
"75244885949787698298913282795963398807",
"321621315134737476890260724131816370360",
"20965748284632994148210757705938643173",
"164467874120547922754436432331549304198",
"296892172092946899309059415897789938893",
"135290251693880790664240529785615635191"
],
"threshold": 0.9
},
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f98ddca48c98e78ba2720ab25c43d02c87a5027",
"target": {
"file": "system/stack/sdp/sdp_utils.cc"
},
"id": "PUB-A-227203684-a951188c"
}
],
"severity": "Moderate"
}