BlueKitchen BTstack Out-of-Bounds Read Vulnerability in AVRCP Controller Handlers

A vulnerability allowing out-of-bounds read has been identified in BlueKitchen BTstack versions prior to 1.8.1. This issue arises in the AVRCP Controller LIST_PLAYER_APPLICATION_SETTING_ATTRIBUTES and LIST_PLAYER_APPLICATION_SETTING_VALUES handlers, where attackers can read beyond buffer boundaries. The vulnerability can be exploited by a nearby attacker with a paired Bluetooth Classic connection, who sends a specially crafted VENDOR_DEPENDENT response containing an attacker-controlled count value. This triggers the out-of-bounds read from the L2CAP receive buffer, potentially causing a crash on resource-constrained devices.

Impact

Exploitation of this vulnerability can lead to a crash on resource-constrained devices.

Remediation

Users are advised to update to BlueKitchen BTstack version 1.8.1 or later.