Description
BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery. A bonded peer can send an AVDTP DISCOVER response with more endpoints than the fixed table holds, causing out-of-bounds writes that corrupt adjacent static objects and crash the process or sever event delivery.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| BlueKitchen | BTstack | ≤ 1.8.2 | — |
References
- Patch Commit patch
- https://github.com/bluekitchen/btstack/blob/v1.8.2/src/classic/a2dp.c#L568 technical-description
- AVDTP L2CAP service registered at the stack default security level technical-description
- https://github.com/bluekitchen/btstack product
- VulnCheck Advisory: BlueKitchen BTstack through 1.8.2 A2DP SEP Discovery Out-of-Bounds Write third-party-advisory