{"id":"PUB-A-260568367","details":"In btm_ble_write_adv_enable_complete of btm_ble_gap.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-260568367","CVE-2023-20989"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2023-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-06-01"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13-next:0"},{"fixed":"13-next:2023-06-01"}]}],"versions":["13-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3a9bc45e212a58ce93cdf39a955324a28144ec32"],"severity":"Moderate","spl":"2023-06-01","types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["166600489234414927719803542116416152193","291053107770608538701183037602824340574","301679025544903014566559251547306239965","247437574063457486823045746346903062022"]},"id":"PUB-A-260568367-1e1073e0","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3a9bc45e212a58ce93cdf39a955324a28144ec32","target":{"file":"system/test/mock/mock_stack_btm_ble_gap.cc"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3a9bc45e212a58ce93cdf39a955324a28144ec32","target":{"file":"system/stack/btm/btm_ble_gap.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["17821528429914078605326521975597115348","182542015634816505864676955174756430311","215603146856888871879870246401244182076","177441206742780684831068774883787682857","252067795639948791246501240899791737952","160022688364382390894069908128400789902"]},"id":"PUB-A-260568367-22106124","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3a9bc45e212a58ce93cdf39a955324a28144ec32","target":{"function":"btu_hcif_hdl_command_complete","file":"system/stack/btu/btu_hcif.cc"},"deprecated":false,"digest":{"length":2154,"function_hash":"75218390152038561042437374292527415286"},"id":"PUB-A-260568367-44558b6b"},{"target":{"file":"system/stack/btm/btm_ble_gap.cc","function":"btm_ble_write_adv_enable_complete"},"deprecated":false,"digest":{"function_hash":"60234447814670367646965507424016961150","length":156},"id":"PUB-A-260568367-4f7a0b8f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3a9bc45e212a58ce93cdf39a955324a28144ec32"},{"target":{"file":"system/stack/btu/btu_hcif.cc"},"deprecated":false,"digest":{"line_hashes":["247225448945770413834114022057397005061","284014206505004169611653158373638260173","95526860695457897301937684495200759154","120411400990972863824583791518870048001"],"threshold":0.9},"id":"PUB-A-260568367-61513c70","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3a9bc45e212a58ce93cdf39a955324a28144ec32"},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3a9bc45e212a58ce93cdf39a955324a28144ec32","target":{"file":"system/stack/include/ble_hci_link_interface.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["188679613354953956492097503756284233815","298775416198561212439457222143063378775","155473432610297448654203097183676318276","288249473609885857912892301994324680310"]},"id":"PUB-A-260568367-c9e2190e","signature_type":"Line","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-260568367.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-06-01"}]}],"versions":["13"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e38dbb297f1ed8e2b0ac3d6147e4cc8744d18b04"],"severity":"Moderate","spl":"2023-06-01","types":["ID"],"vanir_signatures":[{"target":{"function":"btu_hcif_hdl_command_complete","file":"system/stack/btu/btu_hcif.cc"},"deprecated":false,"digest":{"function_hash":"235604982423465775564157247840940631481","length":1979},"id":"PUB-A-260568367-118d7992","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e38dbb297f1ed8e2b0ac3d6147e4cc8744d18b04"},{"digest":{"threshold":0.9,"line_hashes":["21369581572518947376539960550339099673","284014206505004169611653158373638260173","95526860695457897301937684495200759154","120411400990972863824583791518870048001"]},"id":"PUB-A-260568367-4369c66b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e38dbb297f1ed8e2b0ac3d6147e4cc8744d18b04","target":{"file":"system/stack/btu/btu_hcif.cc"},"deprecated":false},{"id":"PUB-A-260568367-471824b9","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e38dbb297f1ed8e2b0ac3d6147e4cc8744d18b04","target":{"file":"system/test/mock/mock_stack_btm_ble_gap.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["166600489234414927719803542116416152193","291053107770608538701183037602824340574","301679025544903014566559251547306239965","247437574063457486823045746346903062022"]}},{"id":"PUB-A-260568367-645f5d1e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e38dbb297f1ed8e2b0ac3d6147e4cc8744d18b04","target":{"file":"system/stack/btm/btm_ble_gap.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["17821528429914078605326521975597115348","182542015634816505864676955174756430311","215603146856888871879870246401244182076","177441206742780684831068774883787682857","252067795639948791246501240899791737952","160022688364382390894069908128400789902"]}},{"id":"PUB-A-260568367-88f387de","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e38dbb297f1ed8e2b0ac3d6147e4cc8744d18b04","target":{"file":"system/stack/include/ble_hci_link_interface.h"},"deprecated":false,"digest":{"line_hashes":["188679613354953956492097503756284233815","298775416198561212439457222143063378775","155473432610297448654203097183676318276","288249473609885857912892301994324680310"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"60234447814670367646965507424016961150","length":156},"id":"PUB-A-260568367-9a8d984b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e38dbb297f1ed8e2b0ac3d6147e4cc8744d18b04","target":{"file":"system/stack/btm/btm_ble_gap.cc","function":"btm_ble_write_adv_enable_complete"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-260568367.json"}}],"schema_version":"1.9.0"}