{"id":"ASB-A-295887535","details":"In attp_build_value_cmd of att_protocol.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-295887535","CVE-2024-0039"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2024-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2024-03-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/17044ccf3a2858633cad8f87926e752edfe0d8d8"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f0f35273101518d1f3a660b151804e90d0249af3"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/015c618a0461def93138173a53daaf27ca0630c9"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14-next:0"},{"fixed":"14-next:2024-03-01"}]}],"versions":["14-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b927f3fb660dafaf97b2fa0398353a8c39125efc","https://android.googlesource.com/platform/packages/modules/Bluetooth/+/074b81c0b0352f254735b6bbd60b0501ac55096b","https://android.googlesource.com/platform/packages/modules/Bluetooth/+/09e48e0d5377ef56a556f9f05ed3e3e97849475e"],"severity":"Critical","spl":"2024-03-01","types":["RCE"],"vanir_signatures":[{"digest":{"line_hashes":["14110221903912855438058865520838285717","96289786954784120315151209674941264891","301947428914401377370371880234052912923","196504407100250633246575651257458747782","91472567662480428040289100240087301204","275187422368600918752220374183304820781","55839518121802372096489907987216166753","332428060753109755875526808231159728522","185513232099437301474493101408523216295","220532208768759993949190902421055519363","125007687658822462701443793970748388945","283159414515024602172586083946591827651","329144891007060192837062170898407653721","147787511722932757543743393726241232556","176681060058112075481043891936815971399","141683149303996989576102567777315931832","124662853024012203018279806279085595949","49937659323552973862763243590449325456","179972565987152308395733266772701040091","239264586812991181918785443643077580097","210858965649663280596861914409565194902","323198502929534331749802939093154304032","325449528027142978704690029105311581468","175893957253260318367636668044127057883","210725645948194812520672404207804616841","37126999780291473166076925868687553804","297540907476269246488054859049307387603","93580845581263614112489837613625596518","296729312086369440192135083326170768002","313581407135081199944023661844864739048","56697825978000885594682066679029605750","70017807537520725341085891901415670695","323160083269779058186146836592869927052","86506767386883301657944122986319108449"],"threshold":0.9},"id":"ASB-A-295887535-3116a55c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b927f3fb660dafaf97b2fa0398353a8c39125efc","target":{"file":"system/stack/gatt/att_protocol.cc"},"deprecated":false},{"id":"ASB-A-295887535-4712a766","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/09e48e0d5377ef56a556f9f05ed3e3e97849475e","target":{"file":"system/stack/gatt/att_protocol.cc","function":"attp_build_value_cmd"},"deprecated":false,"digest":{"function_hash":"116161759212050450161068194770742124445","length":1067}},{"id":"ASB-A-295887535-8d6ed33f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b927f3fb660dafaf97b2fa0398353a8c39125efc","target":{"function":"attp_build_value_cmd","file":"system/stack/gatt/att_protocol.cc"},"deprecated":false,"digest":{"length":1067,"function_hash":"116161759212050450161068194770742124445"}},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/074b81c0b0352f254735b6bbd60b0501ac55096b","target":{"function":"attp_build_value_cmd","file":"system/stack/gatt/att_protocol.cc"},"deprecated":false,"digest":{"function_hash":"101860085083949391930045778871523559507","length":283},"id":"ASB-A-295887535-cec6519b","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/074b81c0b0352f254735b6bbd60b0501ac55096b","target":{"file":"system/stack/gatt/att_protocol.cc"},"deprecated":false,"digest":{"line_hashes":["262052793737009848683627949144756570883","2620899983697621270958166135546666396","184078637487725543100585161708176120248","83800892356238873619038035959339635830","187753795406610831569239171887435677017","10594516150597866487632194291835658011","155357051166553670530980970024261499300","82545403040319563639188475160077374779","83324724150684817983341373127923911730","203384198558095525880264766775409137812","237005054856954347995260967340181291153","87079783638580616507108581456710399424","281260974938958622468964608964686769420","5527077743371978300662653713693542827","154889491036627272244998104148351228930","309544226748686482973683777552664711303","77030012445074694825021361198933900180","129102091069482238311861272735328327817","154883086107031587622631318587316186285","290219773632778731022141433032676660468","243750422467433048270395897487163892153","41067998688836944788336178267799761524","180139992342009461178112939040310493054","10113458376469051509692552876665558106","247612618827287018216874507010327463887","143490447529968365356901985941244848611","94619543440296740648940232035493746677","35534367727080882427743660636247049587","304921345599723399204920995715186059693","215098673835190249962199793817953456666","125435103813922115751211688163559031860","171559785174694317683889917748739218142","230897598609613976210973818755067833219","310644215509690840429061356632039192308","192181489086071488585400953101708462707","238676284701933849630504866278689618653","332694470627817904573366130363929739898","280370392157982657408414143547292543428","147954308535849477449980526300476470338","251890210818412922712515780337495244132","235588325202940975443072493906674823874","70904285491825525999727963804863508988","253894583089172973802804852074566194269","6129595709678567991445896004976141712","198209519604318412433781101741122784299","162952124822853211544566651464943611650","102245364726200595160489026175501783446","30971143604500167574321024292748922891","133170829835068988561762674420684630454","209778762634809918924196549257378468809","93948448630534267037261100943563153300","312228465099380957162740146179351674328","175629558791262739660891295806922924227","139575474406963129142350280687161850472","316653482088553147247158258957556877474","260406926021321159758925401998728449152","248598836724628441297374636966022269176"],"threshold":0.9},"id":"ASB-A-295887535-eca92bd9"},{"target":{"file":"system/stack/gatt/att_protocol.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["14110221903912855438058865520838285717","96289786954784120315151209674941264891","301947428914401377370371880234052912923","196504407100250633246575651257458747782","91472567662480428040289100240087301204","275187422368600918752220374183304820781","55839518121802372096489907987216166753","332428060753109755875526808231159728522","185513232099437301474493101408523216295","220532208768759993949190902421055519363","125007687658822462701443793970748388945","283159414515024602172586083946591827651","329144891007060192837062170898407653721","147787511722932757543743393726241232556","176681060058112075481043891936815971399","141683149303996989576102567777315931832","124662853024012203018279806279085595949","49937659323552973862763243590449325456","179972565987152308395733266772701040091","239264586812991181918785443643077580097","210858965649663280596861914409565194902","323198502929534331749802939093154304032","325449528027142978704690029105311581468","175893957253260318367636668044127057883","210725645948194812520672404207804616841","37126999780291473166076925868687553804","297540907476269246488054859049307387603","93580845581263614112489837613625596518","296729312086369440192135083326170768002","313581407135081199944023661844864739048","56697825978000885594682066679029605750","70017807537520725341085891901415670695","323160083269779058186146836592869927052","86506767386883301657944122986319108449"]},"id":"ASB-A-295887535-ffe27136","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/09e48e0d5377ef56a556f9f05ed3e3e97849475e"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-295887535.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2024-03-01"}]}],"versions":["13"],"ecosystem_specific":{"types":["RCE"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/a0d4425c3964f99f589d449deed2f1bbe520218c","target":{"file":"system/stack/gatt/att_protocol.cc","function":"attp_build_value_cmd"},"deprecated":false,"digest":{"function_hash":"116161759212050450161068194770742124445","length":1067},"id":"ASB-A-295887535-156d49ec"},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/6dbe94fe556ef67f3bbb7d7bb2da3320d68619df","target":{"file":"system/stack/gatt/att_protocol.cc"},"deprecated":false,"digest":{"line_hashes":["262052793737009848683627949144756570883","2620899983697621270958166135546666396","184078637487725543100585161708176120248","83800892356238873619038035959339635830","187753795406610831569239171887435677017","10594516150597866487632194291835658011","155357051166553670530980970024261499300","82545403040319563639188475160077374779","83324724150684817983341373127923911730","203384198558095525880264766775409137812","237005054856954347995260967340181291153","87079783638580616507108581456710399424","281260974938958622468964608964686769420","5527077743371978300662653713693542827","154889491036627272244998104148351228930","309544226748686482973683777552664711303","77030012445074694825021361198933900180","129102091069482238311861272735328327817","154883086107031587622631318587316186285","290219773632778731022141433032676660468","243750422467433048270395897487163892153","41067998688836944788336178267799761524","180139992342009461178112939040310493054","10113458376469051509692552876665558106","247612618827287018216874507010327463887","143490447529968365356901985941244848611","94619543440296740648940232035493746677","35534367727080882427743660636247049587","304921345599723399204920995715186059693","215098673835190249962199793817953456666","125435103813922115751211688163559031860","171559785174694317683889917748739218142","230897598609613976210973818755067833219","310644215509690840429061356632039192308","192181489086071488585400953101708462707","238676284701933849630504866278689618653","332694470627817904573366130363929739898","280370392157982657408414143547292543428","147954308535849477449980526300476470338","251890210818412922712515780337495244132","235588325202940975443072493906674823874","70904285491825525999727963804863508988","253894583089172973802804852074566194269","6129595709678567991445896004976141712","198209519604318412433781101741122784299","162952124822853211544566651464943611650","102245364726200595160489026175501783446","30971143604500167574321024292748922891","133170829835068988561762674420684630454","209778762634809918924196549257378468809","93948448630534267037261100943563153300","312228465099380957162740146179351674328","175629558791262739660891295806922924227","139575474406963129142350280687161850472","316653482088553147247158258957556877474","260406926021321159758925401998728449152","248598836724628441297374636966022269176"],"threshold":0.9},"id":"ASB-A-295887535-167e8664","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/6dbe94fe556ef67f3bbb7d7bb2da3320d68619df","target":{"file":"system/stack/gatt/att_protocol.cc","function":"attp_build_value_cmd"},"deprecated":false,"digest":{"function_hash":"101860085083949391930045778871523559507","length":283},"id":"ASB-A-295887535-2375428c","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["14110221903912855438058865520838285717","96289786954784120315151209674941264891","301947428914401377370371880234052912923","196504407100250633246575651257458747782","91472567662480428040289100240087301204","275187422368600918752220374183304820781","55839518121802372096489907987216166753","332428060753109755875526808231159728522","185513232099437301474493101408523216295","220532208768759993949190902421055519363","125007687658822462701443793970748388945","283159414515024602172586083946591827651","329144891007060192837062170898407653721","147787511722932757543743393726241232556","176681060058112075481043891936815971399","141683149303996989576102567777315931832","124662853024012203018279806279085595949","49937659323552973862763243590449325456","179972565987152308395733266772701040091","239264586812991181918785443643077580097","210858965649663280596861914409565194902","323198502929534331749802939093154304032","325449528027142978704690029105311581468","175893957253260318367636668044127057883","210725645948194812520672404207804616841","37126999780291473166076925868687553804","297540907476269246488054859049307387603","93580845581263614112489837613625596518","296729312086369440192135083326170768002","313581407135081199944023661844864739048","56697825978000885594682066679029605750","70017807537520725341085891901415670695","323160083269779058186146836592869927052","86506767386883301657944122986319108449"],"threshold":0.9},"id":"ASB-A-295887535-3e18e312","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4ae5e736813bf2928bfc8c71e3dacf3b78394046","target":{"file":"system/stack/gatt/att_protocol.cc"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4ae5e736813bf2928bfc8c71e3dacf3b78394046","target":{"function":"attp_build_value_cmd","file":"system/stack/gatt/att_protocol.cc"},"deprecated":false,"digest":{"function_hash":"116161759212050450161068194770742124445","length":1067},"id":"ASB-A-295887535-87aa8d01"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/a0d4425c3964f99f589d449deed2f1bbe520218c","target":{"file":"system/stack/gatt/att_protocol.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["14110221903912855438058865520838285717","96289786954784120315151209674941264891","301947428914401377370371880234052912923","196504407100250633246575651257458747782","91472567662480428040289100240087301204","275187422368600918752220374183304820781","55839518121802372096489907987216166753","332428060753109755875526808231159728522","185513232099437301474493101408523216295","220532208768759993949190902421055519363","125007687658822462701443793970748388945","283159414515024602172586083946591827651","329144891007060192837062170898407653721","147787511722932757543743393726241232556","176681060058112075481043891936815971399","141683149303996989576102567777315931832","124662853024012203018279806279085595949","49937659323552973862763243590449325456","179972565987152308395733266772701040091","239264586812991181918785443643077580097","210858965649663280596861914409565194902","323198502929534331749802939093154304032","325449528027142978704690029105311581468","175893957253260318367636668044127057883","210725645948194812520672404207804616841","37126999780291473166076925868687553804","297540907476269246488054859049307387603","93580845581263614112489837613625596518","296729312086369440192135083326170768002","313581407135081199944023661844864739048","56697825978000885594682066679029605750","70017807537520725341085891901415670695","323160083269779058186146836592869927052","86506767386883301657944122986319108449"]},"id":"ASB-A-295887535-9b81ab59"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/a0d4425c3964f99f589d449deed2f1bbe520218c","https://android.googlesource.com/platform/packages/modules/Bluetooth/+/6dbe94fe556ef67f3bbb7d7bb2da3320d68619df","https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4ae5e736813bf2928bfc8c71e3dacf3b78394046"],"severity":"Critical","spl":"2024-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-295887535.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2024-03-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"Critical","spl":"2024-03-01","types":["RCE"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/6dbe94fe556ef67f3bbb7d7bb2da3320d68619df","target":{"file":"system/stack/gatt/att_protocol.cc"},"deprecated":false,"digest":{"line_hashes":["262052793737009848683627949144756570883","2620899983697621270958166135546666396","184078637487725543100585161708176120248","83800892356238873619038035959339635830","187753795406610831569239171887435677017","10594516150597866487632194291835658011","155357051166553670530980970024261499300","82545403040319563639188475160077374779","83324724150684817983341373127923911730","203384198558095525880264766775409137812","237005054856954347995260967340181291153","87079783638580616507108581456710399424","281260974938958622468964608964686769420","5527077743371978300662653713693542827","154889491036627272244998104148351228930","309544226748686482973683777552664711303","77030012445074694825021361198933900180","129102091069482238311861272735328327817","154883086107031587622631318587316186285","290219773632778731022141433032676660468","243750422467433048270395897487163892153","41067998688836944788336178267799761524","180139992342009461178112939040310493054","10113458376469051509692552876665558106","247612618827287018216874507010327463887","143490447529968365356901985941244848611","94619543440296740648940232035493746677","35534367727080882427743660636247049587","304921345599723399204920995715186059693","215098673835190249962199793817953456666","125435103813922115751211688163559031860","171559785174694317683889917748739218142","230897598609613976210973818755067833219","310644215509690840429061356632039192308","192181489086071488585400953101708462707","238676284701933849630504866278689618653","332694470627817904573366130363929739898","280370392157982657408414143547292543428","147954308535849477449980526300476470338","251890210818412922712515780337495244132","235588325202940975443072493906674823874","70904285491825525999727963804863508988","253894583089172973802804852074566194269","6129595709678567991445896004976141712","198209519604318412433781101741122784299","162952124822853211544566651464943611650","102245364726200595160489026175501783446","30971143604500167574321024292748922891","133170829835068988561762674420684630454","209778762634809918924196549257378468809","93948448630534267037261100943563153300","312228465099380957162740146179351674328","175629558791262739660891295806922924227","139575474406963129142350280687161850472","316653482088553147247158258957556877474","260406926021321159758925401998728449152","248598836724628441297374636966022269176"],"threshold":0.9},"id":"ASB-A-295887535-1dc2face","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/a0d4425c3964f99f589d449deed2f1bbe520218c","target":{"file":"system/stack/gatt/att_protocol.cc","function":"attp_build_value_cmd"},"deprecated":false,"digest":{"length":1067,"function_hash":"116161759212050450161068194770742124445"},"id":"ASB-A-295887535-50920ab5","signature_type":"Function"},{"target":{"function":"attp_build_value_cmd","file":"system/stack/gatt/att_protocol.cc"},"deprecated":false,"digest":{"function_hash":"116161759212050450161068194770742124445","length":1067},"id":"ASB-A-295887535-57d20fc1","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4ae5e736813bf2928bfc8c71e3dacf3b78394046"},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/a0d4425c3964f99f589d449deed2f1bbe520218c","target":{"file":"system/stack/gatt/att_protocol.cc"},"deprecated":false,"digest":{"line_hashes":["14110221903912855438058865520838285717","96289786954784120315151209674941264891","301947428914401377370371880234052912923","196504407100250633246575651257458747782","91472567662480428040289100240087301204","275187422368600918752220374183304820781","55839518121802372096489907987216166753","332428060753109755875526808231159728522","185513232099437301474493101408523216295","220532208768759993949190902421055519363","125007687658822462701443793970748388945","283159414515024602172586083946591827651","329144891007060192837062170898407653721","147787511722932757543743393726241232556","176681060058112075481043891936815971399","141683149303996989576102567777315931832","124662853024012203018279806279085595949","49937659323552973862763243590449325456","179972565987152308395733266772701040091","239264586812991181918785443643077580097","210858965649663280596861914409565194902","323198502929534331749802939093154304032","325449528027142978704690029105311581468","175893957253260318367636668044127057883","210725645948194812520672404207804616841","37126999780291473166076925868687553804","297540907476269246488054859049307387603","93580845581263614112489837613625596518","296729312086369440192135083326170768002","313581407135081199944023661844864739048","56697825978000885594682066679029605750","70017807537520725341085891901415670695","323160083269779058186146836592869927052","86506767386883301657944122986319108449"],"threshold":0.9},"id":"ASB-A-295887535-6e6971c0","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/6dbe94fe556ef67f3bbb7d7bb2da3320d68619df","target":{"file":"system/stack/gatt/att_protocol.cc","function":"attp_build_value_cmd"},"deprecated":false,"digest":{"function_hash":"101860085083949391930045778871523559507","length":283},"id":"ASB-A-295887535-7bb89597","signature_type":"Function"},{"id":"ASB-A-295887535-87e367d0","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4ae5e736813bf2928bfc8c71e3dacf3b78394046","target":{"file":"system/stack/gatt/att_protocol.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["14110221903912855438058865520838285717","96289786954784120315151209674941264891","301947428914401377370371880234052912923","196504407100250633246575651257458747782","91472567662480428040289100240087301204","275187422368600918752220374183304820781","55839518121802372096489907987216166753","332428060753109755875526808231159728522","185513232099437301474493101408523216295","220532208768759993949190902421055519363","125007687658822462701443793970748388945","283159414515024602172586083946591827651","329144891007060192837062170898407653721","147787511722932757543743393726241232556","176681060058112075481043891936815971399","141683149303996989576102567777315931832","124662853024012203018279806279085595949","49937659323552973862763243590449325456","179972565987152308395733266772701040091","239264586812991181918785443643077580097","210858965649663280596861914409565194902","323198502929534331749802939093154304032","325449528027142978704690029105311581468","175893957253260318367636668044127057883","210725645948194812520672404207804616841","37126999780291473166076925868687553804","297540907476269246488054859049307387603","93580845581263614112489837613625596518","296729312086369440192135083326170768002","313581407135081199944023661844864739048","56697825978000885594682066679029605750","70017807537520725341085891901415670695","323160083269779058186146836592869927052","86506767386883301657944122986319108449"]}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/a0d4425c3964f99f589d449deed2f1bbe520218c","https://android.googlesource.com/platform/packages/modules/Bluetooth/+/6dbe94fe556ef67f3bbb7d7bb2da3320d68619df","https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4ae5e736813bf2928bfc8c71e3dacf3b78394046"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-295887535.json"}}],"schema_version":"1.9.0"}