{"id":"ASB-A-260230151","details":"In bta_av_config_ind of bta_av_aact.cc, there is a possible out of bounds read due to type confusion. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-260230151","CVE-2023-35657"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-05-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-05-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/655dbc919736f0a67c5d408e91b6c0a47fb7ccc3"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2025-05-01"}]}],"versions":["15-next"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d5ec52732410406d4adf6bab85bb981f836b32dc","target":{"file":"system/bta/av/bta_av_aact.cc","function":"bta_av_setconfig_rej"},"deprecated":false,"digest":{"function_hash":"16960945942744483288779341569105289904","length":497},"id":"ASB-A-260230151-10c0414d","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["24722393924068985003472469871278814224","91996796257887544603553692058525565990","232575053746628639781353200377541806808","52369250472187051960610881616222735489","97144488170958606537098860304510512672","152846350169814279093831517277329438888","54684041525377672883469224777743820816","196470281291749717999253989053268998971","260394036237009321628299211160613752655","326749476786465189258828274847878856507","85056414098347095732497647907352782528","273978465967577292389321255542342081049","16487139598688149776593751648832317610","304324477403798901640468759292609307010","43096468301225879277351137230515747921","311288204852176252135823325347080670361","64153222830176523055390062812597138582","65675177733969015141694552234698361891","143490395233177618047209890214700967367","149340711416611300505655382141404456112"],"threshold":0.9},"id":"ASB-A-260230151-3484df1d","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/286538b8e52dbb8efd26ccdb240949ffeb3ad2b5","target":{"file":"system/bta/av/bta_av_aact.cc"},"deprecated":false},{"deprecated":false,"digest":{"length":739,"function_hash":"115940089443962809550325303604834031068"},"id":"ASB-A-260230151-494f7038","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/286538b8e52dbb8efd26ccdb240949ffeb3ad2b5","target":{"file":"system/bta/av/bta_av_aact.cc","function":"bta_av_setconfig_rej"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/97c9c472f6b63b86bdf9cfd054490051e881c013","target":{"file":"system/bta/av/bta_av_aact.cc"},"deprecated":false,"digest":{"line_hashes":["38148001691759657804134104837309888917","129693504356707904426038198799710253633","334597965141643051274618653529164707699","20493763997289717859754072174442169422","162562487665790670067297569207094497737","152846350169814279093831517277329438888","54684041525377672883469224777743820816","196470281291749717999253989053268998971"],"threshold":0.9},"id":"ASB-A-260230151-4e669df5","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/97c9c472f6b63b86bdf9cfd054490051e881c013","target":{"file":"system/bta/av/bta_av_aact.cc","function":"bta_av_setconfig_rej"},"deprecated":false,"digest":{"length":486,"function_hash":"332587188464506192292087593302759985103"},"id":"ASB-A-260230151-8e13d122","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4dddbdda5ce8ee6bb04e6a518de20126b85b6119","target":{"file":"system/bta/av/bta_av_aact.cc"},"deprecated":false,"digest":{"line_hashes":["43637795621576944181473650082548683951","189994263394856985670484093391554533803","72349451366330368231205175023404075768","136268239645180415597184079174962771346","24144776941759346397084068370252343831","75943171629679731922973348509685778195","304324477403798901640468759292609307010","43096468301225879277351137230515747921","311288204852176252135823325347080670361","38793563272626801603378424053565598491","233366446562329169882718642036025467190","200754103265358974279902326367101713911"],"threshold":0.9},"id":"ASB-A-260230151-a7fbbdf2","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["47925593307657160469514984364341114999","149641749152895584502001184186866016075","267670287302059460702956949988702352847","169429051243805734673656416741613359787","291973683208436808477292632527695281086","75943171629679731922973348509685778195","304324477403798901640468759292609307010","43096468301225879277351137230515747921","311288204852176252135823325347080670361"],"threshold":0.9},"id":"ASB-A-260230151-c0239632","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d5ec52732410406d4adf6bab85bb981f836b32dc","target":{"file":"system/bta/av/bta_av_aact.cc"}},{"digest":{"function_hash":"285015544729865574002720717848431429603","length":487},"id":"ASB-A-260230151-d830902f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4dddbdda5ce8ee6bb04e6a518de20126b85b6119","target":{"file":"system/bta/av/bta_av_aact.cc","function":"bta_av_setconfig_rej"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d5ec52732410406d4adf6bab85bb981f836b32dc","https://android.googlesource.com/platform/packages/modules/Bluetooth/+/97c9c472f6b63b86bdf9cfd054490051e881c013","https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4dddbdda5ce8ee6bb04e6a518de20126b85b6119","https://android.googlesource.com/platform/packages/modules/Bluetooth/+/286538b8e52dbb8efd26ccdb240949ffeb3ad2b5"],"severity":"High","spl":"2025-05-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-260230151.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-05-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2025-05-01","types":["ID"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4cb4f37ffc89c8a143fffce0a26c48e31de1bbb8","target":{"file":"system/bta/av/bta_av_aact.cc"},"deprecated":false,"digest":{"line_hashes":["75943171629679731922973348509685778195","304324477403798901640468759292609307010","43096468301225879277351137230515747921","311288204852176252135823325347080670361"],"threshold":0.9},"id":"ASB-A-260230151-925c5b96"},{"deprecated":false,"digest":{"length":487,"function_hash":"285015544729865574002720717848431429603"},"id":"ASB-A-260230151-df6893ef","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4cb4f37ffc89c8a143fffce0a26c48e31de1bbb8","target":{"function":"bta_av_setconfig_rej","file":"system/bta/av/bta_av_aact.cc"}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4cb4f37ffc89c8a143fffce0a26c48e31de1bbb8"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-260230151.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-05-01"}]}],"versions":["13"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["227707895056148603516463919740528510145","143946361298361834186525419292571018765","37989374752585201082758080648018967642","202454408074883958844014796457162960037"]},"id":"ASB-A-260230151-02fbe9af","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/a7cfdf76f02fa2b615a8c568c868370565463c76","target":{"file":"system/bta/av/bta_av_aact.cc"}},{"digest":{"function_hash":"134393177023642745561840329805721414817","length":494},"id":"ASB-A-260230151-1c7aa437","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bbd88e88ce749aab87178e189a05e5a356d0631c","target":{"file":"system/bta/av/bta_av_aact.cc","function":"bta_av_setconfig_rej"},"deprecated":false},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/5a4c8f3bd96c822ef733fa0e2784af8713c8bdab","target":{"file":"system/bta/av/bta_av_aact.cc"},"deprecated":false,"digest":{"line_hashes":["168944574313951584934841120728294238908","274000373511619465058470520106006606681","90483408705858340780830632584376823652","237278203730155847693486972272289701798","20493763997289717859754072174442169422","180467764108842910729813132978085692352","112192355781258064684960702574471136442","128264984640156559808813502809823338924","11323686388328064446060580707189939283"],"threshold":0.9},"id":"ASB-A-260230151-4952a813","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"134393177023642745561840329805721414817","length":494},"id":"ASB-A-260230151-9e66da25","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/a7cfdf76f02fa2b615a8c568c868370565463c76","target":{"function":"bta_av_setconfig_rej","file":"system/bta/av/bta_av_aact.cc"},"deprecated":false},{"id":"ASB-A-260230151-b84796a4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bbd88e88ce749aab87178e189a05e5a356d0631c","target":{"file":"system/bta/av/bta_av_aact.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["188494936330993502686196251953522837445","15837631973841489353081313416406467550","70479837834492215329942777949266173976","169429051243805734673656416741613359787","291973683208436808477292632527695281086","227707895056148603516463919740528510145","143946361298361834186525419292571018765","37989374752585201082758080648018967642","202454408074883958844014796457162960037"]}},{"target":{"file":"system/bta/av/bta_av_aact.cc","function":"bta_av_setconfig_rej"},"deprecated":false,"digest":{"function_hash":"312327279270915611920361484245614820499","length":483},"id":"ASB-A-260230151-f01ccdb9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/5a4c8f3bd96c822ef733fa0e2784af8713c8bdab"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bbd88e88ce749aab87178e189a05e5a356d0631c","https://android.googlesource.com/platform/packages/modules/Bluetooth/+/5a4c8f3bd96c822ef733fa0e2784af8713c8bdab","https://android.googlesource.com/platform/packages/modules/Bluetooth/+/a7cfdf76f02fa2b615a8c568c868370565463c76"],"severity":"High","spl":"2025-05-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-260230151.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-05-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b1bc3ea26b71ad7b32b29a001d6974ea6a99d02b"],"severity":"High","spl":"2025-05-01","types":["ID"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["75943171629679731922973348509685778195","304324477403798901640468759292609307010","43096468301225879277351137230515747921","311288204852176252135823325347080670361"]},"id":"ASB-A-260230151-81571018","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b1bc3ea26b71ad7b32b29a001d6974ea6a99d02b","target":{"file":"system/bta/av/bta_av_aact.cc"},"deprecated":false},{"target":{"file":"system/bta/av/bta_av_aact.cc","function":"bta_av_setconfig_rej"},"deprecated":false,"digest":{"function_hash":"16960945942744483288779341569105289904","length":497},"id":"ASB-A-260230151-8f3bbf07","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b1bc3ea26b71ad7b32b29a001d6974ea6a99d02b"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-260230151.json"}}],"schema_version":"1.9.0"}