In onisolinkqualityread of btmisoimpl.h, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the Bluetooth server with System execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/6ee00faaec12f0631c490cc1cca5f645c617aff0"
],
"severity": "Moderate",
"types": [
"ID"
],
"vanir_signatures": [
{
"id": "PUB-A-260568750-d5172d63",
"digest": {
"threshold": 0.9,
"line_hashes": [
"336182745763625551841039275102296750561",
"115480141108283230814474971520204765480",
"42238014775519316689335802152380446620"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "system/stack/btm/btm_iso_impl.h"
},
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/6ee00faaec12f0631c490cc1cca5f645c617aff0",
"signature_version": "v1"
}
],
"spl": "2023-06-01"
}
{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f7679c19e64e23697df81d14d085c94b5af01eed"
],
"severity": "Moderate",
"types": [
"ID"
],
"vanir_signatures": [
{
"id": "PUB-A-260568750-42714bb0",
"digest": {
"threshold": 0.9,
"line_hashes": [
"336182745763625551841039275102296750561",
"115480141108283230814474971520204765480",
"42238014775519316689335802152380446620"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "system/stack/btm/btm_iso_impl.h"
},
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f7679c19e64e23697df81d14d085c94b5af01eed",
"signature_version": "v1"
}
],
"spl": "2023-06-01"
}