{"id":"PUB-A-254445961","details":"In btu_ble_proc_ltk_req of btu_hcif.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-254445961","CVE-2023-21199"],"modified":"2026-09-22T15:22:15.314525410Z","published":"2023-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-06-01"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13-next:0"},{"fixed":"13-next:2023-06-01"}]}],"versions":["13-next"],"ecosystem_specific":{"vanir_signatures":[{"id":"PUB-A-254445961-6604ce50","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/47cd3886c89138bb2de237e634c64d43a65408df","target":{"function":"btu_ble_proc_ltk_req","file":"system/stack/btu/btu_hcif.cc"},"deprecated":false,"digest":{"length":178,"function_hash":"16798783374027649390924088481954397025"}},{"target":{"file":"system/stack/btu/btu_hcif.cc","function":"btu_hcif_process_event"},"deprecated":false,"digest":{"length":4858,"function_hash":"121032340395118351048104805696206638258"},"id":"PUB-A-254445961-c1e915b8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/47cd3886c89138bb2de237e634c64d43a65408df"},{"target":{"file":"system/stack/btu/btu_hcif.cc"},"deprecated":false,"digest":{"line_hashes":["120526818870592079511446038379599419139","247788363735877317492870273049275417386","200524781882001211848731753649556762663","67197072511179158624227833662691877381","243582895289472071154733820146401512678","300957555434471442382439564930068526347","218102751831207072837103522413269025164","128409333108039728423972662664844690397","273463484305711229073194788669961469845","220170635470911562743011761929869734586","45678469202134914128930537096516061788","14813399178371133576513754082925666734","12801990629679320064526008507160949430","299162396192643926634009006467643212504"],"threshold":0.9},"id":"PUB-A-254445961-d0446bb1","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/47cd3886c89138bb2de237e634c64d43a65408df"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/47cd3886c89138bb2de237e634c64d43a65408df"],"severity":"Moderate","spl":"2023-06-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-254445961.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-06-01"}]}],"versions":["13"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/47cd3886c89138bb2de237e634c64d43a65408df"],"severity":"Moderate","spl":"2023-06-01","types":["ID"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/47cd3886c89138bb2de237e634c64d43a65408df","target":{"file":"system/stack/btu/btu_hcif.cc","function":"btu_ble_proc_ltk_req"},"deprecated":false,"digest":{"length":178,"function_hash":"16798783374027649390924088481954397025"},"id":"PUB-A-254445961-0ad65b38","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["120526818870592079511446038379599419139","247788363735877317492870273049275417386","200524781882001211848731753649556762663","67197072511179158624227833662691877381","243582895289472071154733820146401512678","300957555434471442382439564930068526347","218102751831207072837103522413269025164","128409333108039728423972662664844690397","273463484305711229073194788669961469845","220170635470911562743011761929869734586","45678469202134914128930537096516061788","14813399178371133576513754082925666734","12801990629679320064526008507160949430","299162396192643926634009006467643212504"],"threshold":0.9},"id":"PUB-A-254445961-3312e123","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/47cd3886c89138bb2de237e634c64d43a65408df","target":{"file":"system/stack/btu/btu_hcif.cc"}},{"digest":{"length":4858,"function_hash":"121032340395118351048104805696206638258"},"id":"PUB-A-254445961-63060d6c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/47cd3886c89138bb2de237e634c64d43a65408df","target":{"file":"system/stack/btu/btu_hcif.cc","function":"btu_hcif_process_event"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-254445961.json"}}],"schema_version":"1.9.0"}