Description
BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery. A bonded peer can send an AVDTP DISCOVER response with more endpoints than the fixed table holds, causing out-of-bounds writes that corrupt adjacent static objects and crash the process or sever event delivery.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
BlueKitchen GmbH BTstack
Default version status: unaffected
0 to ≤ 1.8.2affected
pkg:github/bluekitchen/btstackReferences
- https://github.com/bluekitchen/btstack/commit/fc208fcce056d4e0a5bb916abc90e83a383e1cdf ↗
- https://github.com/bluekitchen/btstack/blob/v1.8.2/src/classic/a2dp.c#L568 ↗
- https://github.com/bluekitchen/btstack/blob/v1.8.2/src/classic/avdtp.c#L1703 ↗
- https://github.com/bluekitchen/btstack ↗
- https://www.vulncheck.com/advisories/bluekitchen-btstack-through-1.8.2-a2dp-sep-discovery-out-of-bounds-write ↗