In btmbleupdateinqresult of btmblegap.cc, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
{ "fixes": [ "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/70ab248059d86fa759627b8121b0a8880c982302" ], "types": [ "ID" ], "spl": "2023-06-01", "vanir_signatures": [ { "signature_type": "Function", "signature_version": "v1", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/70ab248059d86fa759627b8121b0a8880c982302", "deprecated": false, "digest": { "length": 2848.0, "function_hash": "199569595006823782257596810689626396978" }, "target": { "function": "btm_ble_update_inq_result", "file": "system/stack/btm/btm_ble_gap.cc" }, "id": "PUB-A-264624283-83c24533" }, { "signature_type": "Line", "signature_version": "v1", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/70ab248059d86fa759627b8121b0a8880c982302", "deprecated": false, "digest": { "line_hashes": [ "101134899967797481357420567711456322276", "158461182448082205290765127463070286544", "95011044237623300927781625058674480253", "217616323269986906510589354251642675794" ], "threshold": 0.9 }, "target": { "file": "system/stack/btm/btm_ble_gap.cc" }, "id": "PUB-A-264624283-8a83236c" } ], "severity": "Moderate" }
{ "fixes": [ "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/70ab248059d86fa759627b8121b0a8880c982302" ], "types": [ "ID" ], "spl": "2023-06-01", "vanir_signatures": [ { "signature_type": "Function", "signature_version": "v1", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/70ab248059d86fa759627b8121b0a8880c982302", "deprecated": false, "digest": { "length": 2848.0, "function_hash": "199569595006823782257596810689626396978" }, "target": { "function": "btm_ble_update_inq_result", "file": "system/stack/btm/btm_ble_gap.cc" }, "id": "PUB-A-264624283-220568f6" }, { "signature_type": "Line", "signature_version": "v1", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/70ab248059d86fa759627b8121b0a8880c982302", "deprecated": false, "digest": { "line_hashes": [ "101134899967797481357420567711456322276", "158461182448082205290765127463070286544", "95011044237623300927781625058674480253", "217616323269986906510589354251642675794" ], "threshold": 0.9 }, "target": { "file": "system/stack/btm/btm_ble_gap.cc" }, "id": "PUB-A-264624283-55455ff9" } ], "severity": "Moderate" }