{"id":"ASB-A-275057847","details":"In multiple functions of btm_ble_gap.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-275057847","CVE-2023-45773"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2023-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/7b30443dac7bb9138275c909549110191bcbcae9"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14-next:0"},{"fixed":"14-next:2023-12-01"}]}],"versions":["14-next"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"function_hash":"246882659036614777100561683410077148485","length":949},"id":"ASB-A-275057847-202324b2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"file":"system/stack/btm/btm_ble_gap.cc","function":"BTM_BlePeriodicSyncSetInfo"},"deprecated":false},{"id":"ASB-A-275057847-5669f9e2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"function":"BTM_BlePeriodicSyncTransfer","file":"system/stack/btm/btm_ble_gap.cc"},"deprecated":false,"digest":{"function_hash":"97755488648926379772386719676982052545","length":966}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"file":"system/stack/btm/btm_ble_gap.cc","function":"btm_ble_start_sync_timeout"},"deprecated":false,"digest":{"function_hash":"126904548340751815989801536040087105665","length":631},"id":"ASB-A-275057847-6678219f","signature_type":"Function"},{"id":"ASB-A-275057847-9a9f5c36","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"file":"system/stack/btm/btm_ble_gap.cc","function":"btm_ble_start_sync_request"},"deprecated":false,"digest":{"function_hash":"130921702505814118263895064456259885378","length":680}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"file":"system/stack/btm/btm_ble_gap.cc"},"deprecated":false,"digest":{"line_hashes":["43864245619447460749875237851787664551","167548532180185462033831461179691632619","33575135035212560886115356346310377998","226756959700525368721015644821424642847","15368537722831841663178536074201952112","67674782737042082763137047287714577766","226622384061478884546808137033764846404","12088250185168833025521856155059416891","152668483481076418644668288044788974127","214232302117138856613462659433579297534","140344414876104536602397486092947308877","217766433110994427985590687834173348340","263151270257031066669012561786751224421","248130766202438940892703797255664643667","32053527644928171251614505547020290214","101572736127874747516684315745846603189","296379762876518701606384767804258646863","151263010402120895611752760767850715445","53791275150963334587617480176223235502","101572736127874747516684315745846603189","296379762876518701606384767804258646863","151263010402120895611752760767850715445","53791275150963334587617480176223235502"],"threshold":0.9},"id":"ASB-A-275057847-9b85f3c0","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"function":"BTM_BleStartPeriodicSync","file":"system/stack/btm/btm_ble_gap.cc"},"deprecated":false,"digest":{"function_hash":"78668012657219645030498776305440712796","length":570},"id":"ASB-A-275057847-eb0cb207","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf"],"severity":"High","spl":"2023-12-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-275057847.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-12-01"}]}],"versions":["13"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"function_hash":"130921702505814118263895064456259885378","length":680},"id":"ASB-A-275057847-30ae00e4","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"file":"system/stack/btm/btm_ble_gap.cc","function":"btm_ble_start_sync_request"},"deprecated":false},{"digest":{"line_hashes":["43864245619447460749875237851787664551","167548532180185462033831461179691632619","33575135035212560886115356346310377998","226756959700525368721015644821424642847","15368537722831841663178536074201952112","67674782737042082763137047287714577766","226622384061478884546808137033764846404","12088250185168833025521856155059416891","152668483481076418644668288044788974127","214232302117138856613462659433579297534","140344414876104536602397486092947308877","217766433110994427985590687834173348340","263151270257031066669012561786751224421","248130766202438940892703797255664643667","32053527644928171251614505547020290214","101572736127874747516684315745846603189","296379762876518701606384767804258646863","151263010402120895611752760767850715445","53791275150963334587617480176223235502","101572736127874747516684315745846603189","296379762876518701606384767804258646863","151263010402120895611752760767850715445","53791275150963334587617480176223235502"],"threshold":0.9},"id":"ASB-A-275057847-3e2df005","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"file":"system/stack/btm/btm_ble_gap.cc"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"126904548340751815989801536040087105665","length":631},"id":"ASB-A-275057847-48c0e647","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"function":"btm_ble_start_sync_timeout","file":"system/stack/btm/btm_ble_gap.cc"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"function":"BTM_BlePeriodicSyncTransfer","file":"system/stack/btm/btm_ble_gap.cc"},"deprecated":false,"digest":{"function_hash":"97755488648926379772386719676982052545","length":966},"id":"ASB-A-275057847-5e9fba60","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"function":"BTM_BlePeriodicSyncSetInfo","file":"system/stack/btm/btm_ble_gap.cc"},"deprecated":false,"digest":{"function_hash":"246882659036614777100561683410077148485","length":949},"id":"ASB-A-275057847-6b7bdffc","signature_type":"Function"},{"id":"ASB-A-275057847-f446e077","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"function":"BTM_BleStartPeriodicSync","file":"system/stack/btm/btm_ble_gap.cc"},"deprecated":false,"digest":{"length":570,"function_hash":"78668012657219645030498776305440712796"}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf"],"severity":"High","spl":"2023-12-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-275057847.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2023-12-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"file":"system/stack/btm/btm_ble_gap.cc"},"deprecated":false,"digest":{"line_hashes":["43864245619447460749875237851787664551","167548532180185462033831461179691632619","33575135035212560886115356346310377998","226756959700525368721015644821424642847","15368537722831841663178536074201952112","67674782737042082763137047287714577766","226622384061478884546808137033764846404","12088250185168833025521856155059416891","152668483481076418644668288044788974127","214232302117138856613462659433579297534","140344414876104536602397486092947308877","217766433110994427985590687834173348340","263151270257031066669012561786751224421","248130766202438940892703797255664643667","32053527644928171251614505547020290214","101572736127874747516684315745846603189","296379762876518701606384767804258646863","151263010402120895611752760767850715445","53791275150963334587617480176223235502","101572736127874747516684315745846603189","296379762876518701606384767804258646863","151263010402120895611752760767850715445","53791275150963334587617480176223235502"],"threshold":0.9},"id":"ASB-A-275057847-6bab0964","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"file":"system/stack/btm/btm_ble_gap.cc","function":"BTM_BlePeriodicSyncTransfer"},"deprecated":false,"digest":{"function_hash":"97755488648926379772386719676982052545","length":966},"id":"ASB-A-275057847-6f9f6574"},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"file":"system/stack/btm/btm_ble_gap.cc","function":"btm_ble_start_sync_timeout"},"deprecated":false,"digest":{"function_hash":"126904548340751815989801536040087105665","length":631},"id":"ASB-A-275057847-9dc83e9b","signature_type":"Function","signature_version":"v1"},{"id":"ASB-A-275057847-a8e18eb7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"function":"btm_ble_start_sync_request","file":"system/stack/btm/btm_ble_gap.cc"},"deprecated":false,"digest":{"function_hash":"130921702505814118263895064456259885378","length":680}},{"deprecated":false,"digest":{"length":949,"function_hash":"246882659036614777100561683410077148485"},"id":"ASB-A-275057847-d1a7d960","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf","target":{"file":"system/stack/btm/btm_ble_gap.cc","function":"BTM_BlePeriodicSyncSetInfo"}},{"target":{"file":"system/stack/btm/btm_ble_gap.cc","function":"BTM_BleStartPeriodicSync"},"deprecated":false,"digest":{"function_hash":"78668012657219645030498776305440712796","length":570},"id":"ASB-A-275057847-d365650c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3bb913ee8c7da4602798db754045c0fac57afecf"],"severity":"High","spl":"2023-12-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-275057847.json"}}],"schema_version":"1.9.0"}