CVE-2018-9507 - Out-of-bounds Read

Severity

61%

Complexity

65%

Confidentiality

115%

In bta_av_proc_meta_cmd of bta_av_act.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-111893951

CVSS 3.0 Base Score 6.5. CVSS Attack Vector: adjacent_network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVSS 2.0 Base Score 6.1. CVSS Attack Vector: adjacent_network. CVSS Attack Complexity: low. CVSS Vector: (AV:A/AC:L/Au:N/C:C/I:N/A:N).

Demo Examples

Out-of-bounds Read

CWE-125

In the following code, the method retrieves a value from an array at a specific array index location that is given as an input parameter to the method


               }
                     return value;// check that the array index is less than the maximum// length of the array
                           value = array[index];// get the value at the specified index of the array
// if array index is invalid then output error message// and return value indicating errorvalue = -1;

However, this method only verifies that the given array index is less than the maximum length of the array but does not check for the minimum value (CWE-839). This will allow a negative value to be accepted as the input array index, which will result in a out of bounds read (CWE-125) and may allow access to sensitive memory. The input array index should be checked to verify that is within the maximum and minimum range required for the array (CWE-129). In this example the if statement should be modified to include a minimum range check, as shown below.


               ...// check that the array index is within the correct// range of values for the array

Overview

Type

Google Android

First reported 6 years ago

2018-10-02 19:29:00

Last updated 6 years ago

2018-11-20 18:34:00

Affected Software

Google Android (Nougat) 7.0

7.0

Google Android 7.1.1

7.1.1

Google Android 7.1.2

7.1.2

Google Android 8.0

8.0

Google Android 8.1

8.1

Google Android 9.0

9.0

References

105482

Third Party Advisory, VDB Entry

https://android.googlesource.com/platform/system/bt/+/30cec963095366536ca0b1306089154e09bfe1a9

Patch, Vendor Advisory

https://source.android.com/security/bulletin/2018-10-01