ASB-A-174886838

See a problem?

Import Source

https://storage.googleapis.com/android-osv-test/ASB-A-174886838.json

JSON Data

https://api.osv.dev/v1/vulns/ASB-A-174886838

Aliases

A-174886838
CVE-2020-26558

Published

2021-06-01T00:00:00Z

Modified

2024-09-19T16:27:48.834458Z

Summary

Bluetooth security notice: (VU#799380.8 TLP:AMBER)

Details

In smpprocesspairingpublickey of smp_act.cc, there is a possible interception of Bluetooth pairing from an on-path attacker due to improperly used crypto. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

https://source.android.com/security/bulletin/2021-06-01

Affected packages

Android / platform/system/bt

Package

Name: platform/system/bt

Affected ranges

Type: ECOSYSTEM
Events: Introduced

8.1:0

Fixed

8.1:2021-06-05

Affected versions

8.*

8.1

Ecosystem specific

{
    "vanir_signatures": [
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "289348036503237693750322619088948420833",
                    "113250191429836752799163862841550000207",
                    "331053960425758225361103257003729814416",
                    "207831746164957288629718119238310111947",
                    "105776137580159298932102910945176542233",
                    "153629461537024825288662060624494105676",
                    "153546043420296441568151417159088671690",
                    "326845997108222808193591287199879377935"
                ]
            },
            "id": "ASB-A-174886838-0358f436",
            "source": "https://android.googlesource.com/platform/system/bt/+/e11ebfc21963ae905d58c034310efeca0e7cd2ee",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "stack/smp/smp_act.cc"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "length": 453.0,
                "function_hash": "10132587302424572947966096021116714992"
            },
            "id": "ASB-A-174886838-c1a2af2a",
            "source": "https://android.googlesource.com/platform/system/bt/+/e11ebfc21963ae905d58c034310efeca0e7cd2ee",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "stack/smp/smp_act.cc",
                "function": "smp_process_pairing_public_key"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "178765149785881186769487389518368390943",
                    "236577822987019112761204600727746245732",
                    "196014317388040389384885117312020123757",
                    "6097093062625899727487674311033857373"
                ]
            },
            "id": "ASB-A-174886838-e2a14b00",
            "source": "https://android.googlesource.com/platform/system/bt/+/e11ebfc21963ae905d58c034310efeca0e7cd2ee",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "stack/smp/p_256_ecc_pp.h"
            },
            "signature_type": "Line"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/system/bt/+/8106ba379843a3bd17696c902d26c87f690a161a",
        "https://android.googlesource.com/platform/system/bt/+/e11ebfc21963ae905d58c034310efeca0e7cd2ee"
    ],
    "spl": "2021-06-05",
    "severity": "High",
    "types": [
        "EoP"
    ]
}

Android / platform/system/bt

Package

Name: platform/system/bt

Affected ranges

Type: ECOSYSTEM
Events: Introduced

9:0

Fixed

9:2021-06-05

Affected versions

Other

Ecosystem specific

{
    "vanir_signatures": [
        {
            "digest": {
                "length": 790.0,
                "function_hash": "267944826360575437185293007812731396177"
            },
            "id": "ASB-A-174886838-6e1bd762",
            "source": "https://android.googlesource.com/platform/system/bt/+/b7e176df4b9d90dbf8f29678615e6547a6e6d038",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "stack/smp/smp_act.cc",
                "function": "smp_process_pairing_public_key"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "198402448972113750827510259342259951210",
                    "242367377172592070639873429227192577701",
                    "225298528833318638739699273899224148201"
                ]
            },
            "id": "ASB-A-174886838-706f1a2e",
            "source": "https://android.googlesource.com/platform/system/bt/+/b7e176df4b9d90dbf8f29678615e6547a6e6d038",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "stack/smp/smp_act.cc"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "319301799582430733889182248772501151872",
                    "247666890958076284706628938487866211797",
                    "160170070655885631779645320617169661402",
                    "256438432079725943119149612525856012179"
                ]
            },
            "id": "ASB-A-174886838-8c7d9df8",
            "source": "https://android.googlesource.com/platform/system/bt/+/45678238713ba15cca8dd453b992caedf1d43ec5",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "stack/smp/smp_act.cc"
            },
            "signature_type": "Line"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/system/bt/+/b7e176df4b9d90dbf8f29678615e6547a6e6d038",
        "https://android.googlesource.com/platform/system/bt/+/45678238713ba15cca8dd453b992caedf1d43ec5"
    ],
    "spl": "2021-06-05",
    "severity": "High",
    "types": [
        "EoP"
    ]
}

Android / platform/system/bt

Package

Name: platform/system/bt

Affected ranges

Type: ECOSYSTEM
Events: Introduced

10:0

Fixed

10:2021-06-05

Affected versions

Other

Ecosystem specific

{
    "vanir_signatures": [
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "198402448972113750827510259342259951210",
                    "242367377172592070639873429227192577701",
                    "225298528833318638739699273899224148201"
                ]
            },
            "id": "ASB-A-174886838-48617c8a",
            "source": "https://android.googlesource.com/platform/system/bt/+/b7e176df4b9d90dbf8f29678615e6547a6e6d038",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "stack/smp/smp_act.cc"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "319301799582430733889182248772501151872",
                    "247666890958076284706628938487866211797",
                    "160170070655885631779645320617169661402",
                    "256438432079725943119149612525856012179"
                ]
            },
            "id": "ASB-A-174886838-5b0156a0",
            "source": "https://android.googlesource.com/platform/system/bt/+/45678238713ba15cca8dd453b992caedf1d43ec5",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "stack/smp/smp_act.cc"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "length": 790.0,
                "function_hash": "267944826360575437185293007812731396177"
            },
            "id": "ASB-A-174886838-d53ce1b2",
            "source": "https://android.googlesource.com/platform/system/bt/+/b7e176df4b9d90dbf8f29678615e6547a6e6d038",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "stack/smp/smp_act.cc",
                "function": "smp_process_pairing_public_key"
            },
            "signature_type": "Function"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/system/bt/+/b7e176df4b9d90dbf8f29678615e6547a6e6d038",
        "https://android.googlesource.com/platform/system/bt/+/45678238713ba15cca8dd453b992caedf1d43ec5"
    ],
    "spl": "2021-06-05",
    "severity": "High",
    "types": [
        "EoP"
    ]
}

Android / platform/system/bt

Package

Name: platform/system/bt

Affected ranges

Type: ECOSYSTEM
Events: Introduced

11:0

Fixed

11:2021-06-05

Affected versions

Other

Ecosystem specific

{
    "vanir_signatures": [
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "198402448972113750827510259342259951210",
                    "242367377172592070639873429227192577701",
                    "225298528833318638739699273899224148201"
                ]
            },
            "id": "ASB-A-174886838-3aa0e47e",
            "source": "https://android.googlesource.com/platform/system/bt/+/b7e176df4b9d90dbf8f29678615e6547a6e6d038",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "stack/smp/smp_act.cc"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "length": 790.0,
                "function_hash": "267944826360575437185293007812731396177"
            },
            "id": "ASB-A-174886838-45720cb4",
            "source": "https://android.googlesource.com/platform/system/bt/+/b7e176df4b9d90dbf8f29678615e6547a6e6d038",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "stack/smp/smp_act.cc",
                "function": "smp_process_pairing_public_key"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "319301799582430733889182248772501151872",
                    "247666890958076284706628938487866211797",
                    "160170070655885631779645320617169661402",
                    "256438432079725943119149612525856012179"
                ]
            },
            "id": "ASB-A-174886838-8b7f9a07",
            "source": "https://android.googlesource.com/platform/system/bt/+/45678238713ba15cca8dd453b992caedf1d43ec5",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "stack/smp/smp_act.cc"
            },
            "signature_type": "Line"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/system/bt/+/b7e176df4b9d90dbf8f29678615e6547a6e6d038",
        "https://android.googlesource.com/platform/system/bt/+/45678238713ba15cca8dd453b992caedf1d43ec5"
    ],
    "spl": "2021-06-05",
    "severity": "High",
    "types": [
        "EoP"
    ]
}