{"id":"PUB-A-254445961","details":"In btu_ble_proc_ltk_req of btu_hcif.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-254445961","CVE-2023-21199"],"modified":"2026-09-24T20:28:40.724672881Z","published":"2023-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-06-01"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13-next:0"},{"fixed":"13-next:2023-06-01"}]}],"versions":["13-next"],"ecosystem_specific":{"spl":"2023-06-01","types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/47cd3886c89138bb2de237e634c64d43a65408df","target":{"file":"system/stack/btu/btu_hcif.cc","function":"btu_ble_proc_ltk_req"},"deprecated":false,"digest":{"function_hash":"16798783374027649390924088481954397025","length":178},"id":"PUB-A-254445961-6604ce50","signature_type":"Function","signature_version":"v1"},{"id":"PUB-A-254445961-c1e915b8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/47cd3886c89138bb2de237e634c64d43a65408df","target":{"function":"btu_hcif_process_event","file":"system/stack/btu/btu_hcif.cc"},"deprecated":false,"digest":{"function_hash":"121032340395118351048104805696206638258","length":4858}},{"digest":{"line_hashes":["120526818870592079511446038379599419139","247788363735877317492870273049275417386","200524781882001211848731753649556762663","67197072511179158624227833662691877381","243582895289472071154733820146401512678","300957555434471442382439564930068526347","218102751831207072837103522413269025164","128409333108039728423972662664844690397","273463484305711229073194788669961469845","220170635470911562743011761929869734586","45678469202134914128930537096516061788","14813399178371133576513754082925666734","12801990629679320064526008507160949430","299162396192643926634009006467643212504"],"threshold":0.9},"id":"PUB-A-254445961-d0446bb1","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/47cd3886c89138bb2de237e634c64d43a65408df","target":{"file":"system/stack/btu/btu_hcif.cc"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/47cd3886c89138bb2de237e634c64d43a65408df"],"severity":"Moderate"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-254445961.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-06-01"}]}],"versions":["13"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"function_hash":"16798783374027649390924088481954397025","length":178},"id":"PUB-A-254445961-0ad65b38","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/47cd3886c89138bb2de237e634c64d43a65408df","target":{"function":"btu_ble_proc_ltk_req","file":"system/stack/btu/btu_hcif.cc"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/47cd3886c89138bb2de237e634c64d43a65408df","target":{"file":"system/stack/btu/btu_hcif.cc"},"deprecated":false,"digest":{"line_hashes":["120526818870592079511446038379599419139","247788363735877317492870273049275417386","200524781882001211848731753649556762663","67197072511179158624227833662691877381","243582895289472071154733820146401512678","300957555434471442382439564930068526347","218102751831207072837103522413269025164","128409333108039728423972662664844690397","273463484305711229073194788669961469845","220170635470911562743011761929869734586","45678469202134914128930537096516061788","14813399178371133576513754082925666734","12801990629679320064526008507160949430","299162396192643926634009006467643212504"],"threshold":0.9},"id":"PUB-A-254445961-3312e123"},{"id":"PUB-A-254445961-63060d6c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/47cd3886c89138bb2de237e634c64d43a65408df","target":{"function":"btu_hcif_process_event","file":"system/stack/btu/btu_hcif.cc"},"deprecated":false,"digest":{"function_hash":"121032340395118351048104805696206638258","length":4858}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/47cd3886c89138bb2de237e634c64d43a65408df"],"severity":"Moderate","spl":"2023-06-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-254445961.json"}}],"schema_version":"1.9.0"}