{"id":"ASB-A-172670415","details":"In onBatchScanReports and deliverBatchScan of GattService.java, there is a possible way to retrieve Bluetooth scan results without permissions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-172670415","CVE-2021-0328"],"modified":"2026-05-29T15:55:33.750044621Z","published":"2021-02-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2021-02-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/6f7f9bbf46acaaf266537256da4d0345909ea1c4"}],"affected":[{"package":{"name":"platform/packages/apps/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0:0"},{"fixed":"8.0:2021-02-01"}]}],"versions":["8.0"],"ecosystem_specific":{"spl":"2021-02-01","vanir_signatures":[{"target":{"file":"src/com/android/bluetooth/gatt/GattService.java"},"digest":{"threshold":0.9,"line_hashes":["62637463839837125086876068015025273969","38270130599441381463735570736799822404","195096344871186794395214098527183077533","85178481723156268957428251907431641949","193415904547943498162279726599686424159","88806902401815437722027234400844152704","21350239549760555821094269345351742450","337188717553211345690156008185681630492","101216632476963660759321528229588000937","46022503581342692754263094024415558664","313874570163440170746622256905708417180","57859124448746707765054464906393609726","283524686749161234451096108757056134326","249623149264698505304643346478833532494","229441578597004240020271146844174930709","257302227022005399365821461138133502102","237336725475634246690373654317658797276","251943799740403344409888645521693820664","77592495947522646339966218863454620141","297150821219752747575223256882298182202","132933073459527881868398518962440084842"]},"deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/6f7f9bbf46acaaf266537256da4d0345909ea1c4","signature_type":"Line","signature_version":"v1","id":"ASB-A-172670415-1d273f16"},{"id":"ASB-A-172670415-4f65dbf2","source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/6f7f9bbf46acaaf266537256da4d0345909ea1c4","digest":{"length":866,"function_hash":"226707436334932483421368165759926246640"},"deprecated":false,"signature_type":"Function","signature_version":"v1","target":{"function":"onBatchScanReports","file":"src/com/android/bluetooth/gatt/GattService.java"}},{"target":{"function":"deliverBatchScan","file":"src/com/android/bluetooth/gatt/GattService.java"},"digest":{"length":453,"function_hash":"130891963601117552561634610282874083676"},"deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/6f7f9bbf46acaaf266537256da4d0345909ea1c4","signature_type":"Function","signature_version":"v1","id":"ASB-A-172670415-d64850d6"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Bluetooth/+/6f7f9bbf46acaaf266537256da4d0345909ea1c4"],"severity":"High","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-172670415.json"}},{"package":{"name":"platform/packages/apps/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1:0"},{"fixed":"8.1:2021-02-01"}]}],"versions":["8.1"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"id":"ASB-A-172670415-2cdf817d","digest":{"length":453,"function_hash":"130891963601117552561634610282874083676"},"deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/6f7f9bbf46acaaf266537256da4d0345909ea1c4","signature_type":"Function","signature_version":"v1","target":{"function":"deliverBatchScan","file":"src/com/android/bluetooth/gatt/GattService.java"}},{"id":"ASB-A-172670415-88048cad","digest":{"length":866,"function_hash":"226707436334932483421368165759926246640"},"deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/6f7f9bbf46acaaf266537256da4d0345909ea1c4","signature_type":"Function","signature_version":"v1","target":{"function":"onBatchScanReports","file":"src/com/android/bluetooth/gatt/GattService.java"}},{"target":{"file":"src/com/android/bluetooth/gatt/GattService.java"},"source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/6f7f9bbf46acaaf266537256da4d0345909ea1c4","digest":{"threshold":0.9,"line_hashes":["62637463839837125086876068015025273969","38270130599441381463735570736799822404","195096344871186794395214098527183077533","85178481723156268957428251907431641949","193415904547943498162279726599686424159","88806902401815437722027234400844152704","21350239549760555821094269345351742450","337188717553211345690156008185681630492","101216632476963660759321528229588000937","46022503581342692754263094024415558664","313874570163440170746622256905708417180","57859124448746707765054464906393609726","283524686749161234451096108757056134326","249623149264698505304643346478833532494","229441578597004240020271146844174930709","257302227022005399365821461138133502102","237336725475634246690373654317658797276","251943799740403344409888645521693820664","77592495947522646339966218863454620141","297150821219752747575223256882298182202","132933073459527881868398518962440084842"]},"deprecated":false,"signature_type":"Line","signature_version":"v1","id":"ASB-A-172670415-d1738758"}],"severity":"High","fixes":["https://android.googlesource.com/platform/packages/apps/Bluetooth/+/6f7f9bbf46acaaf266537256da4d0345909ea1c4"],"spl":"2021-02-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-172670415.json"}},{"package":{"name":"platform/packages/apps/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9:0"},{"fixed":"9:2021-02-01"}]}],"versions":["9"],"ecosystem_specific":{"spl":"2021-02-01","vanir_signatures":[{"target":{"function":"deliverBatchScan","file":"src/com/android/bluetooth/gatt/GattService.java"},"digest":{"length":453,"function_hash":"130891963601117552561634610282874083676"},"deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/6f7f9bbf46acaaf266537256da4d0345909ea1c4","signature_type":"Function","signature_version":"v1","id":"ASB-A-172670415-1134e146"},{"id":"ASB-A-172670415-bc635f75","digest":{"threshold":0.9,"line_hashes":["62637463839837125086876068015025273969","38270130599441381463735570736799822404","195096344871186794395214098527183077533","85178481723156268957428251907431641949","193415904547943498162279726599686424159","88806902401815437722027234400844152704","21350239549760555821094269345351742450","337188717553211345690156008185681630492","101216632476963660759321528229588000937","46022503581342692754263094024415558664","313874570163440170746622256905708417180","57859124448746707765054464906393609726","283524686749161234451096108757056134326","249623149264698505304643346478833532494","229441578597004240020271146844174930709","257302227022005399365821461138133502102","237336725475634246690373654317658797276","251943799740403344409888645521693820664","77592495947522646339966218863454620141","297150821219752747575223256882298182202","132933073459527881868398518962440084842"]},"deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/6f7f9bbf46acaaf266537256da4d0345909ea1c4","signature_type":"Line","signature_version":"v1","target":{"file":"src/com/android/bluetooth/gatt/GattService.java"}},{"target":{"function":"onBatchScanReports","file":"src/com/android/bluetooth/gatt/GattService.java"},"source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/6f7f9bbf46acaaf266537256da4d0345909ea1c4","digest":{"length":866,"function_hash":"226707436334932483421368165759926246640"},"deprecated":false,"signature_type":"Function","signature_version":"v1","id":"ASB-A-172670415-d16017d9"}],"severity":"High","fixes":["https://android.googlesource.com/platform/packages/apps/Bluetooth/+/6f7f9bbf46acaaf266537256da4d0345909ea1c4"],"types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-172670415.json"}},{"package":{"name":"platform/packages/apps/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2021-02-01"}]}],"versions":["10"],"ecosystem_specific":{"spl":"2021-02-01","vanir_signatures":[{"target":{"function":"onBatchScanReports","file":"src/com/android/bluetooth/gatt/GattService.java"},"digest":{"length":866,"function_hash":"226707436334932483421368165759926246640"},"deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/6f7f9bbf46acaaf266537256da4d0345909ea1c4","signature_type":"Function","signature_version":"v1","id":"ASB-A-172670415-2cd8e591"},{"target":{"file":"src/com/android/bluetooth/gatt/GattService.java"},"digest":{"threshold":0.9,"line_hashes":["62637463839837125086876068015025273969","38270130599441381463735570736799822404","195096344871186794395214098527183077533","85178481723156268957428251907431641949","193415904547943498162279726599686424159","88806902401815437722027234400844152704","21350239549760555821094269345351742450","337188717553211345690156008185681630492","101216632476963660759321528229588000937","46022503581342692754263094024415558664","313874570163440170746622256905708417180","57859124448746707765054464906393609726","283524686749161234451096108757056134326","249623149264698505304643346478833532494","229441578597004240020271146844174930709","257302227022005399365821461138133502102","237336725475634246690373654317658797276","251943799740403344409888645521693820664","77592495947522646339966218863454620141","297150821219752747575223256882298182202","132933073459527881868398518962440084842"]},"deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/6f7f9bbf46acaaf266537256da4d0345909ea1c4","signature_type":"Line","signature_version":"v1","id":"ASB-A-172670415-8b3030b3"},{"id":"ASB-A-172670415-9009c94e","deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/6f7f9bbf46acaaf266537256da4d0345909ea1c4","digest":{"length":453,"function_hash":"130891963601117552561634610282874083676"},"signature_type":"Function","signature_version":"v1","target":{"function":"deliverBatchScan","file":"src/com/android/bluetooth/gatt/GattService.java"}}],"severity":"High","fixes":["https://android.googlesource.com/platform/packages/apps/Bluetooth/+/6f7f9bbf46acaaf266537256da4d0345909ea1c4"],"types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-172670415.json"}},{"package":{"name":"platform/packages/apps/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2021-02-01"}]}],"versions":["11"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"id":"ASB-A-172670415-04442104","deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/6f7f9bbf46acaaf266537256da4d0345909ea1c4","digest":{"length":453,"function_hash":"130891963601117552561634610282874083676"},"signature_type":"Function","signature_version":"v1","target":{"function":"deliverBatchScan","file":"src/com/android/bluetooth/gatt/GattService.java"}},{"target":{"file":"src/com/android/bluetooth/gatt/GattService.java"},"digest":{"threshold":0.9,"line_hashes":["62637463839837125086876068015025273969","38270130599441381463735570736799822404","195096344871186794395214098527183077533","85178481723156268957428251907431641949","193415904547943498162279726599686424159","88806902401815437722027234400844152704","21350239549760555821094269345351742450","337188717553211345690156008185681630492","101216632476963660759321528229588000937","46022503581342692754263094024415558664","313874570163440170746622256905708417180","57859124448746707765054464906393609726","283524686749161234451096108757056134326","249623149264698505304643346478833532494","229441578597004240020271146844174930709","257302227022005399365821461138133502102","237336725475634246690373654317658797276","251943799740403344409888645521693820664","77592495947522646339966218863454620141","297150821219752747575223256882298182202","132933073459527881868398518962440084842"]},"deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/6f7f9bbf46acaaf266537256da4d0345909ea1c4","signature_type":"Line","signature_version":"v1","id":"ASB-A-172670415-7b5d30e2"},{"id":"ASB-A-172670415-9059506a","digest":{"length":866,"function_hash":"226707436334932483421368165759926246640"},"deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/6f7f9bbf46acaaf266537256da4d0345909ea1c4","signature_type":"Function","signature_version":"v1","target":{"function":"onBatchScanReports","file":"src/com/android/bluetooth/gatt/GattService.java"}}],"severity":"High","fixes":["https://android.googlesource.com/platform/packages/apps/Bluetooth/+/6f7f9bbf46acaaf266537256da4d0345909ea1c4"],"spl":"2021-02-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-172670415.json"}}],"schema_version":"1.7.5"}