In btmbleclearresolvinglistcompletecomplete of btmble_privacy.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
{ "vanir_signatures": [ { "signature_type": "Line", "signature_version": "v1", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/6394b5241202b3d6a178ed5f43bdc50ddd1049a4", "id": "PUB-A-255304475-76881c45", "deprecated": false, "target": { "file": "system/stack/btm/btm_ble_privacy.cc" }, "digest": { "threshold": 0.9, "line_hashes": [ "92758987078148568019158656197107221739", "73319185189381520922773215846740391383", "276910450462051422505174347180321263225", "145038479121754964278160808675247973350" ] } }, { "signature_type": "Function", "signature_version": "v1", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/6394b5241202b3d6a178ed5f43bdc50ddd1049a4", "id": "PUB-A-255304475-ca1aa402", "deprecated": false, "target": { "file": "system/stack/btm/btm_ble_privacy.cc", "function": "btm_ble_clear_resolving_list_complete" }, "digest": { "length": 732.0, "function_hash": "108602830100535714132872259133274609913" } }, { "signature_type": "Line", "signature_version": "v1", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f5dd3cabff177a2f6c76d11a182f1bd24851f054", "id": "PUB-A-255304475-cdf755a4", "deprecated": false, "target": { "file": "system/stack/test/btm/stack_btm_regression_tests.cc" }, "digest": { "threshold": 0.9, "line_hashes": [ "305704574833606312109134593358507186611" ] } } ], "severity": "Moderate", "types": [ "ID" ], "spl": "2023-06-01", "fixes": [ "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/6394b5241202b3d6a178ed5f43bdc50ddd1049a4", "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f5dd3cabff177a2f6c76d11a182f1bd24851f054" ] }
{ "vanir_signatures": [ { "signature_type": "Line", "signature_version": "v1", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/125762848b7af6606021cf3b59e505b5445fe975", "id": "PUB-A-255304475-34fb5436", "deprecated": false, "target": { "file": "system/stack/btm/btm_ble_privacy.cc" }, "digest": { "threshold": 0.9, "line_hashes": [ "92758987078148568019158656197107221739", "73319185189381520922773215846740391383", "276910450462051422505174347180321263225", "145038479121754964278160808675247973350" ] } }, { "signature_type": "Line", "signature_version": "v1", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/362a9148030ecbfafd4af459e9861648cb143bc8", "id": "PUB-A-255304475-42f6e6b4", "deprecated": false, "target": { "file": "system/stack/test/btm/stack_btm_regression_tests.cc" }, "digest": { "threshold": 0.9, "line_hashes": [ "305704574833606312109134593358507186611" ] } }, { "signature_type": "Function", "signature_version": "v1", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/125762848b7af6606021cf3b59e505b5445fe975", "id": "PUB-A-255304475-45834a4b", "deprecated": false, "target": { "file": "system/stack/btm/btm_ble_privacy.cc", "function": "btm_ble_clear_resolving_list_complete" }, "digest": { "length": 732.0, "function_hash": "108602830100535714132872259133274609913" } } ], "severity": "Moderate", "types": [ "ID" ], "spl": "2023-06-01", "fixes": [ "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/125762848b7af6606021cf3b59e505b5445fe975", "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/362a9148030ecbfafd4af459e9861648cb143bc8" ] }