CVE-2023-21125

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-21125
In btif_hh_hsdata_rpt_copy_cb of bta_hh.cc, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.

8.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://android.googlesource.com/platform/system/bt/+/e7b978841deb331ff5e5849388fa92ee4c40f979 Product
https://source.android.com/security/bulletin/2025-03-01 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:12.1:*:*:*:*:*:*:*
History

02 Sep 2025, 18:08

Type Values Removed Values Added
First Time Google android
Google
CPE cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:12.1:*:*:*:*:*:*:*
References () https://android.googlesource.com/platform/system/bt/+/e7b978841deb331ff5e5849388fa92ee4c40f979 - () https://android.googlesource.com/platform/system/bt/+/e7b978841deb331ff5e5849388fa92ee4c40f979 - Product
References () https://source.android.com/security/bulletin/2025-03-01 - () https://source.android.com/security/bulletin/2025-03-01 - Vendor Advisory

27 Aug 2025, 15:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 7.8 		v2 : unknown
v3 : 8.0
CWE CWE-400 CWE-416

27 Aug 2025, 14:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
Summary
  • (es) En btif_hh_hsdata_rpt_copy_cb de bta_hh.cc, existe una posible forma de corromper la memoria debido a un use after free. Esto podría provocar una escalada local de privilegios sobre Bluetooth sin necesidad de privilegios de ejecución adicionales. No se requiere la interacción del usuario para su explotación.
CWE CWE-400

26 Aug 2025, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-26 23:15

Updated : 2025-09-02 18:08

NVD link : CVE-2023-21125

Mitre link : CVE-2023-21125

CVE.ORG link : CVE-2023-21125

JSON object : View

Products Affected

google

  • android
CWE
CWE-416

Use After Free