CVE-2022-20445 in Android
Summary
by MITRE • 11/09/2022
In process_service_search_rsp of sdp_discovery.cc, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-225876506
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/15/2026
The vulnerability identified as CVE-2022-20445 resides within the Bluetooth service discovery protocol implementation of Android operating systems across multiple versions including Android 10 through Android 13. This issue manifests in the process_service_search_rsp function located in the sdp_discovery.cc source file, which handles service discovery protocol responses during Bluetooth device pairing and service enumeration processes. The flaw represents a classic out-of-bounds read condition that occurs when the system fails to properly validate incoming Bluetooth service discovery packets before processing them.
The technical root cause of this vulnerability stems from inadequate input validation mechanisms within the Bluetooth service discovery protocol handler. When an Android device receives a malformed service discovery response packet from a remote Bluetooth device, the system attempts to parse and process the packet without sufficient bounds checking on array indices or buffer sizes. This allows an attacker positioned remotely to craft specially constructed Bluetooth service discovery responses that trigger memory access violations beyond the allocated buffer boundaries. The vulnerability specifically affects the service discovery protocol implementation that operates at the Bluetooth layer, which is part of the core Android Bluetooth stack responsible for device discovery and service enumeration.
The operational impact of this vulnerability is significant as it enables remote information disclosure without requiring any additional execution privileges or user interaction. An attacker can exploit this weakness by establishing a Bluetooth connection to a vulnerable Android device and sending malicious service discovery responses that trigger the out-of-bounds read condition. This can potentially expose sensitive memory contents including device identifiers, Bluetooth addresses, and other internal system information that could be leveraged for further attacks. The vulnerability operates at the system level within the Bluetooth stack, making it particularly dangerous as it can be exploited without user consent or interaction, and the attacker does not need elevated privileges to execute the attack.
From a cybersecurity perspective, this vulnerability aligns with CWE-129, which addresses improper validation of array index bounds, and represents a typical example of how Bluetooth protocol implementations can be compromised through insufficient input validation. The attack vector follows the ATT&CK framework's T1046 technique for network service scanning and T1059 for command and control communications, as the vulnerability enables an attacker to gather information about the target device and potentially establish further attack vectors. The vulnerability's classification as a remote information disclosure aligns with the Common Vulnerability Scoring System's remote attack requirements and the lack of user interaction needed for exploitation indicates a CVSS score that would typically be rated as medium to high severity. Organizations should prioritize patching this vulnerability across all affected Android versions and implement network-level monitoring to detect suspicious Bluetooth service discovery traffic patterns.