Paper/Archive/CVE-2023-21250

CVE-2023-21250

Google Android — In gatt_end_operation of gatt_utils.cc, there is a possible out of bounds write due to a missing bounds check.

EPSS 0.6%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 46.4.464 × 209.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

In gatt_end_operation of gatt_utils.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected

ProductAffectedFixed inSource

Android13–CNA

Android12L–CNA

Android12–CNA

Android11–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refandroid.googlesource.com/platform/packages/modules/Bluetooth/+/ec573bc83f1ed6722f7cb29431dcb2db7f10bf28 refsource.android.com/security/bulletin/2023-07-01