BlueKitchen BTstack Out-of-Bounds Read Vulnerability in AVRCP Controller Handlers

An out-of-bounds read vulnerability has been identified in BlueKitchen BTstack versions prior to 1.8.1. This vulnerability exists in the AVRCP Controller GET_PLAYER_APPLICATION_SETTING_ATTRIBUTE_TEXT and GET_PLAYER_APPLICATION_SETTING_VALUE_TEXT handlers. It allows nearby attackers to read beyond packet boundaries by establishing a paired Bluetooth Classic connection and sending specially crafted VENDOR_DEPENDENT responses. This exploitation can lead to information disclosure and potential crashes on affected devices.

Impact

Exploitation of this vulnerability causes out-of-bounds reads, which can result in information disclosure and potential crashes on the affected device.

Remediation

Users can upgrade to BlueKitchen BTstack version 1.8.1 or later to address this vulnerability.