{"id":"ASB-A-242459126","details":"In several functions that parse avrc response in avrc_pars_ct.cc and related files, there are possible out of bounds reads due to integer overflows. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-242459126","CVE-2022-20483"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2022-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8ac0a48db690b05eebb59fc84f18552b01ab8b2c"}],"affected":[{"package":{"name":"platform/system/bt","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2022-12-01"}]}],"versions":["10"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/bt/+/a593687d6ad3978f48e2aa7be57d8239acdfa501"],"severity":"High","spl":"2022-12-01","types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"246261309292627764850062454137925587454","length":7455},"id":"ASB-A-242459126-6d11409c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/a593687d6ad3978f48e2aa7be57d8239acdfa501","target":{"function":"avrc_pars_browse_rsp","file":"stack/avrc/avrc_pars_ct.cc"}},{"target":{"file":"stack/avdt/avdt_scb_act.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["294951957758731757883929783887153109394","106092106196867649537503733370584611217","189088425660910814142726109873825984855","316101027153247806185933113651988306833"]},"id":"ASB-A-242459126-c3817ab0","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/a593687d6ad3978f48e2aa7be57d8239acdfa501"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/a593687d6ad3978f48e2aa7be57d8239acdfa501","target":{"file":"stack/avrc/avrc_pars_ct.cc","function":"avrc_ctrl_pars_vendor_rsp"},"deprecated":false,"digest":{"function_hash":"182181507504243184593892589672924655533","length":10046},"id":"ASB-A-242459126-e3452247","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/a593687d6ad3978f48e2aa7be57d8239acdfa501","target":{"file":"stack/avrc/avrc_pars_ct.cc"},"deprecated":false,"digest":{"line_hashes":["42538941206984305746808001609364071807","283172030838849731686565523093910918221","39139926188413564802078928481522074765","311755542531161657961406815165134364868","77437360373551084412906542537933870132","45338132021932059406025890633027944994","22374565261471676541104117760654558254","205383540660728581862661079473971017412","265639436082591935765082639297941220591","104530918131640819031209048685412644204","211569170838139487330377367042390026355","50859189555771318655512556890545391887","37987262780069043698210642574115783470","302300129936106847824067063054204102640","147424000817720264926473601989472270602","87788634039812734572083734458981631617","186920431596338125782696635621768250015","20973358694280050576045381785401344700","14206460160729439864124687037751469160","244671148784153364616600634136824193627","33179517896122327432848286461882600676","234756797173427210151600990620808545847","324714166699590664543710661170943189829","136599248133576336266047237681205021466","117887301360496443842634321829010979999","136941538595518801375062306300803749167","172208303681125830869373558524173605091","204246094064791826844306736887222471991","208288615714043555055310942620876017782","225373824314722723620560767139532108656","103894435365450518097244279113983329231","163858361045844675629920062696687180081","177155031663407308845191359888568482071","92777672652809493923586353485315914342","269066076220080101795498639790173869498","191497140579927098208497330494489660224","317150493250768652388712909772290746776","163263351866088725998715961117918649349","27924676983385213481425784756427546923","333408129928969069098920578522634449234","132985237111156264551930290257049511467","299125783314592134592630297450511569020","279734738679560628290350153072006291326","323264323582100027633358929499132693836","194725805933585227050168247858491778856","121846924495495557793687417869781995850"],"threshold":0.9},"id":"ASB-A-242459126-f772b346"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-242459126.json"}},{"package":{"name":"platform/system/bt","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2022-12-01"}]}],"versions":["11"],"ecosystem_specific":{"spl":"2022-12-01","types":["ID"],"vanir_signatures":[{"id":"ASB-A-242459126-270be361","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/18fd685cfcc2690a9748a29721a1c275ec18448b","target":{"file":"stack/avdt/avdt_scb_act.cc"},"deprecated":false,"digest":{"line_hashes":["294951957758731757883929783887153109394","106092106196867649537503733370584611217","189088425660910814142726109873825984855","316101027153247806185933113651988306833"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/system/bt/+/18fd685cfcc2690a9748a29721a1c275ec18448b","target":{"file":"stack/avrc/avrc_pars_ct.cc","function":"avrc_ctrl_pars_vendor_rsp"},"deprecated":false,"digest":{"function_hash":"232893974152485457752308754038103338862","length":10051},"id":"ASB-A-242459126-5b654859","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["37749218793717328795563377109440803076","44946156696954722578495468585956510048","52452797935843806212817606584203054844","246205513692637647263517856602517489832"],"threshold":0.9},"id":"ASB-A-242459126-85793bd8","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/18fd685cfcc2690a9748a29721a1c275ec18448b","target":{"file":"stack/avrc/avrc_pars_tg.cc"},"deprecated":false},{"digest":{"function_hash":"124300245596748489386475012786339789761","length":8594},"id":"ASB-A-242459126-a6793fb3","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/18fd685cfcc2690a9748a29721a1c275ec18448b","target":{"function":"avrc_pars_browse_rsp","file":"stack/avrc/avrc_pars_ct.cc"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/18fd685cfcc2690a9748a29721a1c275ec18448b","target":{"file":"stack/avrc/avrc_pars_ct.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["42538941206984305746808001609364071807","283172030838849731686565523093910918221","39139926188413564802078928481522074765","311755542531161657961406815165134364868","77437360373551084412906542537933870132","45338132021932059406025890633027944994","22374565261471676541104117760654558254","205383540660728581862661079473971017412","265639436082591935765082639297941220591","104530918131640819031209048685412644204","211569170838139487330377367042390026355","50859189555771318655512556890545391887","37987262780069043698210642574115783470","302300129936106847824067063054204102640","147424000817720264926473601989472270602","87788634039812734572083734458981631617","186920431596338125782696635621768250015","20973358694280050576045381785401344700","14206460160729439864124687037751469160","244671148784153364616600634136824193627","33179517896122327432848286461882600676","234756797173427210151600990620808545847","324714166699590664543710661170943189829","136599248133576336266047237681205021466","117887301360496443842634321829010979999","136941538595518801375062306300803749167","2987902877867746836249445921153022500","68132529070989801875441727549896483288","189831954230377371847567509080754373459","323216392069820833784336958856023997159","186920431596338125782696635621768250015","20973358694280050576045381785401344700","14206460160729439864124687037751469160","244671148784153364616600634136824193627","33179517896122327432848286461882600676","234756797173427210151600990620808545847","324714166699590664543710661170943189829","242766292978590427635836270506785685287","117887301360496443842634321829010979999","239405381410001264851500894700313036954","172208303681125830869373558524173605091","204246094064791826844306736887222471991","208288615714043555055310942620876017782","225373824314722723620560767139532108656","103894435365450518097244279113983329231","163858361045844675629920062696687180081","177155031663407308845191359888568482071","92777672652809493923586353485315914342","269066076220080101795498639790173869498","191497140579927098208497330494489660224","317150493250768652388712909772290746776","163263351866088725998715961117918649349","27924676983385213481425784756427546923","333408129928969069098920578522634449234","132985237111156264551930290257049511467","299125783314592134592630297450511569020","279734738679560628290350153072006291326","323264323582100027633358929499132693836","194725805933585227050168247858491778856","121846924495495557793687417869781995850"]},"id":"ASB-A-242459126-eb1de278"}],"fixes":["https://android.googlesource.com/platform/system/bt/+/18fd685cfcc2690a9748a29721a1c275ec18448b"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-242459126.json"}},{"package":{"name":"platform/system/bt","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2022-12-01"}]}],"versions":["12"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"124300245596748489386475012786339789761","length":8594},"id":"ASB-A-242459126-3f8ce32d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/44df45d0385f501150b2221c1c7a02a4d7f5b6d1","target":{"function":"avrc_pars_browse_rsp","file":"stack/avrc/avrc_pars_ct.cc"}},{"id":"ASB-A-242459126-7b71096e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/44df45d0385f501150b2221c1c7a02a4d7f5b6d1","target":{"file":"stack/avrc/avrc_pars_ct.cc","function":"avrc_ctrl_pars_vendor_rsp"},"deprecated":false,"digest":{"length":10051,"function_hash":"232893974152485457752308754038103338862"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["294951957758731757883929783887153109394","106092106196867649537503733370584611217","189088425660910814142726109873825984855","316101027153247806185933113651988306833"]},"id":"ASB-A-242459126-7ce0bad1","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/44df45d0385f501150b2221c1c7a02a4d7f5b6d1","target":{"file":"stack/avdt/avdt_scb_act.cc"}},{"digest":{"line_hashes":["42538941206984305746808001609364071807","283172030838849731686565523093910918221","39139926188413564802078928481522074765","311755542531161657961406815165134364868","77437360373551084412906542537933870132","45338132021932059406025890633027944994","22374565261471676541104117760654558254","205383540660728581862661079473971017412","265639436082591935765082639297941220591","104530918131640819031209048685412644204","211569170838139487330377367042390026355","50859189555771318655512556890545391887","37987262780069043698210642574115783470","302300129936106847824067063054204102640","147424000817720264926473601989472270602","87788634039812734572083734458981631617","186920431596338125782696635621768250015","20973358694280050576045381785401344700","14206460160729439864124687037751469160","244671148784153364616600634136824193627","33179517896122327432848286461882600676","234756797173427210151600990620808545847","324714166699590664543710661170943189829","136599248133576336266047237681205021466","117887301360496443842634321829010979999","136941538595518801375062306300803749167","2987902877867746836249445921153022500","68132529070989801875441727549896483288","189831954230377371847567509080754373459","323216392069820833784336958856023997159","186920431596338125782696635621768250015","20973358694280050576045381785401344700","14206460160729439864124687037751469160","244671148784153364616600634136824193627","33179517896122327432848286461882600676","234756797173427210151600990620808545847","324714166699590664543710661170943189829","242766292978590427635836270506785685287","117887301360496443842634321829010979999","239405381410001264851500894700313036954","172208303681125830869373558524173605091","204246094064791826844306736887222471991","208288615714043555055310942620876017782","225373824314722723620560767139532108656","103894435365450518097244279113983329231","163858361045844675629920062696687180081","177155031663407308845191359888568482071","92777672652809493923586353485315914342","269066076220080101795498639790173869498","191497140579927098208497330494489660224","317150493250768652388712909772290746776","163263351866088725998715961117918649349","27924676983385213481425784756427546923","333408129928969069098920578522634449234","132985237111156264551930290257049511467","299125783314592134592630297450511569020","279734738679560628290350153072006291326","323264323582100027633358929499132693836","194725805933585227050168247858491778856","121846924495495557793687417869781995850"],"threshold":0.9},"id":"ASB-A-242459126-80574824","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/bt/+/44df45d0385f501150b2221c1c7a02a4d7f5b6d1","target":{"file":"stack/avrc/avrc_pars_ct.cc"},"deprecated":false},{"source":"https://android.googlesource.com/platform/system/bt/+/44df45d0385f501150b2221c1c7a02a4d7f5b6d1","target":{"file":"stack/avrc/avrc_pars_tg.cc"},"deprecated":false,"digest":{"line_hashes":["37749218793717328795563377109440803076","44946156696954722578495468585956510048","52452797935843806212817606584203054844","246205513692637647263517856602517489832"],"threshold":0.9},"id":"ASB-A-242459126-f273e810","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/system/bt/+/44df45d0385f501150b2221c1c7a02a4d7f5b6d1"],"severity":"High","spl":"2022-12-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-242459126.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2022-12-01"}]}],"versions":["13"],"ecosystem_specific":{"severity":"High","spl":"2022-12-01","types":["ID"],"vanir_signatures":[{"target":{"file":"system/stack/avrc/avrc_pars_ct.cc","function":"avrc_pars_browse_rsp"},"deprecated":false,"digest":{"function_hash":"124300245596748489386475012786339789761","length":8594},"id":"ASB-A-242459126-30e9cd51","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c99c43f7cc92385921b501dbe1f76f0f3e823488"},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c99c43f7cc92385921b501dbe1f76f0f3e823488","target":{"file":"system/stack/avrc/avrc_pars_tg.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["37749218793717328795563377109440803076","44946156696954722578495468585956510048","52452797935843806212817606584203054844","246205513692637647263517856602517489832"]},"id":"ASB-A-242459126-4d3960a9","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"232893974152485457752308754038103338862","length":10051},"id":"ASB-A-242459126-71aa0cab","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c99c43f7cc92385921b501dbe1f76f0f3e823488","target":{"file":"system/stack/avrc/avrc_pars_ct.cc","function":"avrc_ctrl_pars_vendor_rsp"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c99c43f7cc92385921b501dbe1f76f0f3e823488","target":{"file":"system/stack/avdt/avdt_scb_act.cc"},"deprecated":false,"digest":{"line_hashes":["294951957758731757883929783887153109394","106092106196867649537503733370584611217","189088425660910814142726109873825984855","316101027153247806185933113651988306833"],"threshold":0.9},"id":"ASB-A-242459126-8cc67767","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["42538941206984305746808001609364071807","283172030838849731686565523093910918221","39139926188413564802078928481522074765","311755542531161657961406815165134364868","77437360373551084412906542537933870132","45338132021932059406025890633027944994","22374565261471676541104117760654558254","205383540660728581862661079473971017412","265639436082591935765082639297941220591","104530918131640819031209048685412644204","211569170838139487330377367042390026355","50859189555771318655512556890545391887","37987262780069043698210642574115783470","302300129936106847824067063054204102640","147424000817720264926473601989472270602","87788634039812734572083734458981631617","186920431596338125782696635621768250015","20973358694280050576045381785401344700","14206460160729439864124687037751469160","244671148784153364616600634136824193627","33179517896122327432848286461882600676","234756797173427210151600990620808545847","324714166699590664543710661170943189829","136599248133576336266047237681205021466","117887301360496443842634321829010979999","136941538595518801375062306300803749167","2987902877867746836249445921153022500","68132529070989801875441727549896483288","189831954230377371847567509080754373459","323216392069820833784336958856023997159","186920431596338125782696635621768250015","20973358694280050576045381785401344700","14206460160729439864124687037751469160","244671148784153364616600634136824193627","33179517896122327432848286461882600676","234756797173427210151600990620808545847","324714166699590664543710661170943189829","242766292978590427635836270506785685287","117887301360496443842634321829010979999","239405381410001264851500894700313036954","172208303681125830869373558524173605091","204246094064791826844306736887222471991","208288615714043555055310942620876017782","225373824314722723620560767139532108656","103894435365450518097244279113983329231","163858361045844675629920062696687180081","177155031663407308845191359888568482071","92777672652809493923586353485315914342","269066076220080101795498639790173869498","191497140579927098208497330494489660224","317150493250768652388712909772290746776","163263351866088725998715961117918649349","27924676983385213481425784756427546923","333408129928969069098920578522634449234","132985237111156264551930290257049511467","299125783314592134592630297450511569020","279734738679560628290350153072006291326","323264323582100027633358929499132693836","194725805933585227050168247858491778856","121846924495495557793687417869781995850"],"threshold":0.9},"id":"ASB-A-242459126-b1731b74","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c99c43f7cc92385921b501dbe1f76f0f3e823488","target":{"file":"system/stack/avrc/avrc_pars_ct.cc"}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c99c43f7cc92385921b501dbe1f76f0f3e823488"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-242459126.json"}}],"schema_version":"1.9.0"}