Android Bluetooth Module Unapproved Data Access Vulnerability Allowing Remote Information Disclosure

A vulnerability in the Android Bluetooth module's AdapterService.java file allows for unapproved data access due to a missing permission check. This issue could lead to remote information disclosure without requiring additional execution privileges. Exploitation of this vulnerability does require user interaction.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive data, potentially leading to information disclosure.

Reproduction

The vulnerability can be reproduced by establishing a Bluetooth connection with a device that is not bonded. This will trigger the Phone Book Access Profile connection, which requires user confirmation. The missing permission check in the AdapterService.java file will then allow for unapproved data access, leading to information disclosure.

Remediation

Users can update their devices to the March 2025 security patch level, which addresses this vulnerability.