Description
BlueKitchen BTstack versions prior to 1.8.1 contain an out-of-bounds read vulnerability in the AVRCP Browsing Target GET_FOLDER_ITEMS handler that fails to validate packet boundaries and attribute count data. An attacker with a paired Bluetooth Classic connection can exploit insufficient bounds checking on the attr_id parameter to cause crashes and corrupt attribute bitmap state.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| BlueKitchen | BTstack | < 1.8.1 | 1.8.1 |
References
- BTstack 1.8.1 Release Notes release-notes patch
- https://www.vulncheck.com/advisories/bluekitchen-btstack-avrcp-browsing-target-get-folder-items-handler-oob-read-undefined-behavior third-party-advisory