{"id":"ASB-A-275057843","details":"In multiple functions of btm_ble_gap.cc, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-275057843","CVE-2023-40080"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2023-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/7b30443dac7bb9138275c909549110191bcbcae9"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14-next:0"},{"fixed":"14-next:2023-12-01"}]}],"versions":["14-next"],"ecosystem_specific":{"spl":"2023-12-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"function":"BTM_BlePeriodicSyncSetInfo","file":"system/stack/btm/btm_ble_gap.cc"},"deprecated":false,"digest":{"function_hash":"246882659036614777100561683410077148485","length":949},"id":"ASB-A-275057843-202324b2","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"function":"BTM_BlePeriodicSyncTransfer","file":"system/stack/btm/btm_ble_gap.cc"},"deprecated":false,"digest":{"length":966,"function_hash":"97755488648926379772386719676982052545"},"id":"ASB-A-275057843-5669f9e2","signature_type":"Function"},{"id":"ASB-A-275057843-6678219f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"function":"btm_ble_start_sync_timeout","file":"system/stack/btm/btm_ble_gap.cc"},"deprecated":false,"digest":{"function_hash":"126904548340751815989801536040087105665","length":631}},{"deprecated":false,"digest":{"function_hash":"130921702505814118263895064456259885378","length":680},"id":"ASB-A-275057843-9a9f5c36","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"file":"system/stack/btm/btm_ble_gap.cc","function":"btm_ble_start_sync_request"}},{"digest":{"threshold":0.9,"line_hashes":["43864245619447460749875237851787664551","167548532180185462033831461179691632619","33575135035212560886115356346310377998","226756959700525368721015644821424642847","15368537722831841663178536074201952112","67674782737042082763137047287714577766","226622384061478884546808137033764846404","12088250185168833025521856155059416891","152668483481076418644668288044788974127","214232302117138856613462659433579297534","140344414876104536602397486092947308877","217766433110994427985590687834173348340","263151270257031066669012561786751224421","248130766202438940892703797255664643667","32053527644928171251614505547020290214","101572736127874747516684315745846603189","296379762876518701606384767804258646863","151263010402120895611752760767850715445","53791275150963334587617480176223235502","101572736127874747516684315745846603189","296379762876518701606384767804258646863","151263010402120895611752760767850715445","53791275150963334587617480176223235502"]},"id":"ASB-A-275057843-9b85f3c0","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"file":"system/stack/btm/btm_ble_gap.cc"},"deprecated":false},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"file":"system/stack/btm/btm_ble_gap.cc","function":"BTM_BleStartPeriodicSync"},"deprecated":false,"digest":{"function_hash":"78668012657219645030498776305440712796","length":570},"id":"ASB-A-275057843-eb0cb207","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-275057843.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-12-01"}]}],"versions":["13"],"ecosystem_specific":{"severity":"High","spl":"2023-12-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-275057843-30ae00e4","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"file":"system/stack/btm/btm_ble_gap.cc","function":"btm_ble_start_sync_request"},"deprecated":false,"digest":{"function_hash":"130921702505814118263895064456259885378","length":680}},{"id":"ASB-A-275057843-3e2df005","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"file":"system/stack/btm/btm_ble_gap.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["43864245619447460749875237851787664551","167548532180185462033831461179691632619","33575135035212560886115356346310377998","226756959700525368721015644821424642847","15368537722831841663178536074201952112","67674782737042082763137047287714577766","226622384061478884546808137033764846404","12088250185168833025521856155059416891","152668483481076418644668288044788974127","214232302117138856613462659433579297534","140344414876104536602397486092947308877","217766433110994427985590687834173348340","263151270257031066669012561786751224421","248130766202438940892703797255664643667","32053527644928171251614505547020290214","101572736127874747516684315745846603189","296379762876518701606384767804258646863","151263010402120895611752760767850715445","53791275150963334587617480176223235502","101572736127874747516684315745846603189","296379762876518701606384767804258646863","151263010402120895611752760767850715445","53791275150963334587617480176223235502"]}},{"digest":{"length":631,"function_hash":"126904548340751815989801536040087105665"},"id":"ASB-A-275057843-48c0e647","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"file":"system/stack/btm/btm_ble_gap.cc","function":"btm_ble_start_sync_timeout"},"deprecated":false},{"target":{"file":"system/stack/btm/btm_ble_gap.cc","function":"BTM_BlePeriodicSyncTransfer"},"deprecated":false,"digest":{"length":966,"function_hash":"97755488648926379772386719676982052545"},"id":"ASB-A-275057843-5e9fba60","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf"},{"id":"ASB-A-275057843-6b7bdffc","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"file":"system/stack/btm/btm_ble_gap.cc","function":"BTM_BlePeriodicSyncSetInfo"},"deprecated":false,"digest":{"length":949,"function_hash":"246882659036614777100561683410077148485"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"file":"system/stack/btm/btm_ble_gap.cc","function":"BTM_BleStartPeriodicSync"},"deprecated":false,"digest":{"function_hash":"78668012657219645030498776305440712796","length":570},"id":"ASB-A-275057843-f446e077","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-275057843.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2023-12-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2023-12-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"file":"system/stack/btm/btm_ble_gap.cc"},"deprecated":false,"digest":{"line_hashes":["43864245619447460749875237851787664551","167548532180185462033831461179691632619","33575135035212560886115356346310377998","226756959700525368721015644821424642847","15368537722831841663178536074201952112","67674782737042082763137047287714577766","226622384061478884546808137033764846404","12088250185168833025521856155059416891","152668483481076418644668288044788974127","214232302117138856613462659433579297534","140344414876104536602397486092947308877","217766433110994427985590687834173348340","263151270257031066669012561786751224421","248130766202438940892703797255664643667","32053527644928171251614505547020290214","101572736127874747516684315745846603189","296379762876518701606384767804258646863","151263010402120895611752760767850715445","53791275150963334587617480176223235502","101572736127874747516684315745846603189","296379762876518701606384767804258646863","151263010402120895611752760767850715445","53791275150963334587617480176223235502"],"threshold":0.9},"id":"ASB-A-275057843-6bab0964","signature_type":"Line","signature_version":"v1"},{"id":"ASB-A-275057843-6f9f6574","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"file":"system/stack/btm/btm_ble_gap.cc","function":"BTM_BlePeriodicSyncTransfer"},"deprecated":false,"digest":{"function_hash":"97755488648926379772386719676982052545","length":966}},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"file":"system/stack/btm/btm_ble_gap.cc","function":"btm_ble_start_sync_timeout"},"deprecated":false,"digest":{"length":631,"function_hash":"126904548340751815989801536040087105665"},"id":"ASB-A-275057843-9dc83e9b","signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"file":"system/stack/btm/btm_ble_gap.cc","function":"btm_ble_start_sync_request"},"deprecated":false,"digest":{"length":680,"function_hash":"130921702505814118263895064456259885378"},"id":"ASB-A-275057843-a8e18eb7","signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"file":"system/stack/btm/btm_ble_gap.cc","function":"BTM_BlePeriodicSyncSetInfo"},"deprecated":false,"digest":{"function_hash":"246882659036614777100561683410077148485","length":949},"id":"ASB-A-275057843-d1a7d960","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"file":"system/stack/btm/btm_ble_gap.cc","function":"BTM_BleStartPeriodicSync"},"deprecated":false,"digest":{"function_hash":"78668012657219645030498776305440712796","length":570},"id":"ASB-A-275057843-d365650c","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-275057843.json"}}],"schema_version":"1.9.0"}