BlueKitchen BTstack Out-of-Bounds Read Vulnerability in AVRCP Browsing Target GET_FOLDER_ITEMS Handler

A out-of-bounds read vulnerability has been identified in BlueKitchen BTstack versions prior to 1.8.1. The issue arises in the AVRCP Browsing Target GET_FOLDER_ITEMS handler, which does not properly validate packet boundaries or attribute count data. This vulnerability can be exploited by an attacker with a paired Bluetooth Classic connection, taking advantage of inadequate bounds checking on the attr_id parameter. Exploitation can lead to crashes and corruption of the attribute bitmap state.

Impact

Exploitation of this vulnerability causes crashes and disrupts the attribute bitmap state, leading to undefined behavior.

Remediation

Users can upgrade to BlueKitchen BTstack version 1.8.1 or later to address this vulnerability.