{"id":"ASB-A-280633699","details":"In avdt_msg_asmbl of avdt_msg.cc, there is a possible out of bounds write due to an integer overflow. This could lead to paired device escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-280633699","CVE-2023-35684"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2023-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/668bbca29797728004d88db4c9b69102f3939008"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13-next:0"},{"fixed":"13-next:2023-09-01"}]}],"versions":["13-next"],"ecosystem_specific":{"severity":"High","spl":"2023-09-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bf9449a704c2983861dbe0ede9ab660e42826179","target":{"file":"system/stack/avdt/avdt_msg.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["205503213461534524996964454821878364842","123841091169846678710746539856086903864","221252012638599075510746473711720122832","265981268881668604892832250504896933543","166970167131151963096032843008481224167","74076694523211457375836683700949727555","244151524030131126660541297271967691970"]},"id":"ASB-A-280633699-7490fa0b"},{"id":"ASB-A-280633699-f12d3194","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bf9449a704c2983861dbe0ede9ab660e42826179","target":{"file":"system/stack/avdt/avdt_msg.cc","function":"avdt_msg_asmbl"},"deprecated":false,"digest":{"function_hash":"223273454540487395414285899053428066891","length":2302}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bf9449a704c2983861dbe0ede9ab660e42826179"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-280633699.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-09-01"}]}],"versions":["13"],"ecosystem_specific":{"spl":"2023-09-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-280633699-04893c90","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bf9449a704c2983861dbe0ede9ab660e42826179","target":{"function":"avdt_msg_asmbl","file":"system/stack/avdt/avdt_msg.cc"},"deprecated":false,"digest":{"length":2302,"function_hash":"223273454540487395414285899053428066891"}},{"digest":{"line_hashes":["205503213461534524996964454821878364842","123841091169846678710746539856086903864","221252012638599075510746473711720122832","265981268881668604892832250504896933543","166970167131151963096032843008481224167","74076694523211457375836683700949727555","244151524030131126660541297271967691970"],"threshold":0.9},"id":"ASB-A-280633699-0c923cb5","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bf9449a704c2983861dbe0ede9ab660e42826179","target":{"file":"system/stack/avdt/avdt_msg.cc"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bf9449a704c2983861dbe0ede9ab660e42826179"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-280633699.json"}}],"schema_version":"1.9.0"}