Google Android 8.0/8.1/9.0/10.0 Bluetooth Pairing privileges management

Summaryinfo

A vulnerability was found in Google Android 8.0/8.1/9.0/10.0 and classified as critical. The impacted element is an unknown function of the component Bluetooth Pairing. Such manipulation leads to privileges management. This vulnerability is referenced as CVE-2019-2225. The attack can only be performed from a local environment. No exploit is available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability was found in Google Android 8.0/8.1/9.0/10.0 (Smartphone Operating System). It has been rated as critical. Affected by this issue is an unknown code of the component Bluetooth Pairing. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

When pairing with a Bluetooth device, it may be possible to pair a malicious device without any confirmation from the user, and that device may be able to interact with the phone. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-110433804

The weakness was published 12/06/2019. This vulnerability is handled as CVE-2019-2225 since 12/10/2018. The attack needs to be approached locally. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 03/09/2024). It is expected to see the exploit prices for this product increasing in the near future.The MITRE ATT&CK project declares the attack technique as T1068.

Applying a patch is able to eliminate this problem.

Similar entries are available at VDB-146784, VDB-146783, VDB-146781 and VDB-146782. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

Version

• 8.0
• 8.1
• 9.0
• 10.0

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion