CVE-2024-34727

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-34727
In sdpu_compare_uuid_with_attr of sdp_utils.cc, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://android.googlesource.com/platform/packages/modules/Bluetooth/+/6afad4b377b5bc3f38b28296e746b674173f99d8 Vendor Advisory
https://source.android.com/security/bulletin/2024-08-01 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:12.1:*:*:*:*:*:*:*
cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
History

11 Sep 2024, 12:43

Type Values Removed Values Added
First Time Google
Google android
CWE CWE-120
References () https://android.googlesource.com/platform/packages/modules/Bluetooth/+/6afad4b377b5bc3f38b28296e746b674173f99d8 - () https://android.googlesource.com/platform/packages/modules/Bluetooth/+/6afad4b377b5bc3f38b28296e746b674173f99d8 - Vendor Advisory
References () https://source.android.com/security/bulletin/2024-08-01 - () https://source.android.com/security/bulletin/2024-08-01 - Vendor Advisory
CPE cpe:2.3:o:google:android:12.1:*:*:*:*:*:*:*
cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

19 Aug 2024, 13:00

Type Values Removed Values Added
Summary
  • (es) En sdpu_compare_uuid_with_attr de sdp_utils.cc, existe una posible lectura fuera de los límites debido a un desbordamiento de búfer de almacenamiento dinámico. Esto podría conducir a la divulgación remota de información sin necesidad de privilegios de ejecución adicionales. La interacción del usuario no es necesaria para la explotación.

15 Aug 2024, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-15 22:15

Updated : 2024-09-11 12:43

NVD link : CVE-2024-34727

Mitre link : CVE-2024-34727

CVE.ORG link : CVE-2024-34727

JSON object : View

Products Affected

google

  • android
CWE
CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')