vendor:
N/A
by:
N/A
7.8
CVSS
HIGH
Heap Leak
119
CWE
Product Name: N/A
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: No
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: N/A
2020
Bluetooth Network Encapsulation Protocol (BNEP) Heap Leak
This vulnerability is a heap leak in the Bluetooth Network Encapsulation Protocol (BNEP) which allows an attacker to leak bytes from the heap of com.android.bluetooth. The vulnerability is caused by a lack of proper validation of the length field in the BNEP packet. An attacker can send a BNEP packet with a length field greater than BNEP_FILTER_MULTI_ADDR_RESPONSE_MSG (0x06) and the response sent by bnep_send_command_not_understood() will contain 3 bytes: 0x01 (BNEP_FRAME_CONTROL) + 0x00 (BNEP_CONTROL_COMMAND_NOT_UNDERSTOOD) + leaked byte.
Mitigation:
The best way to mitigate this vulnerability is to ensure that all BNEP packets are properly validated before being processed.
