CVE-2026-19570

WysokieCVSS 8.8

Opublikowano: 09/10/2026(UTC)Zaktualizowano: 04/11/2026(UTC)Przetłumaczono: 09/10/2026(UTC)NVD NIST

Prawdopodobieństwo exploitacji (EPSS)

Niskie ryzyko

0.29%

Percentyl 22 - wyżej niż 22% wszystkich znanych CVE

Streszczenie

Podatność w LE Audio Broadcast Sink (subsys/bluetooth/audio/bap_broadcast_sink.c) pozwala atakującemu w zasięgu radiowym na zapis danych poza granicami statycznej struktury mod_src_param w pamięci .bss. Brak sprawdzenia rozmiaru przy kopiowaniu metadanych podgrup z ramki BASE prowadzi do przepełnienia bufora, co może skutkować zdalnym wykonaniem kodu w wątku Bluetooth RX.

Ocena ryzyka

Atak nie wymaga parowania, bondingu ani połączenia GATT — wystarczy, że urządzenie zsynchronizuje się z fałszywym nadawcą okresowych reklam. Może to prowadzić do przejęcia kontroli nad urządzeniem, ujawnienia pamięci poza zakresem w notyfikacjach BASS lub awarii systemu.

Rekomendacja

Należy natychmiast zastosować poprawkę producenta, która odrzuca BASE z nadmiarowymi podgrupami i pomija metadane nie mieszczące się w buforze. Do czasu aktualizacji ogranicz zasięg Bluetooth lub wyłącz funkcję Broadcast Sink w krytycznych systemach.

Powiązane podatności

Oryginalny opis (angielski, źródło NVD)

The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from a received Basic Audio Announcement (BASE) into the static Broadcast Audio Scan Service parameter structure mod_src_param without any bounds check. In base_subgroup_meta_cb() the destination element was selected as mod_src_param.subgroups[mod_src_param.num_subgroups] with no test against ARRAY_SIZE(mod_src_param.subgroups) (sized by CONFIG_BT_BAP_BASS_MAX_SUBGROUPS, default 1), and the metadata was copied with memcpy() using the raw on-air length returned by bt_bap_base_get_subgroup_codec_meta() into a metadata array sized by CONFIG_BT_AUDIO_CODEC_CFG_MAX_METADATA_SIZE (default 4). The BASE validator bt_bap_base_get_base_from_ad() only checks structural consistency and permits up to ~24 subgroups and metadata LTVs of ~240 octets. The defect is reached from the periodic advertising receive callback: pa_recv() → bt_data_parse() → pa_decode_base() → update_recv_state_base() → bt_bap_base_foreach_subgroup() → base_subgroup_meta_cb(). Every broadcast sink registers a scan-delegator receive state at creation (bt_bap_broadcast_sink_create() calls broadcast_sink_add_src()), and CONFIG_BT_BAP_BROADCAST_SINK depends on CONFIG_BT_BAP_SCAN_DELEGATOR, so the path is active in every broadcast-sink build once the device is periodic-advertising-synced. An attacker in radio range who operates a broadcast source the device syncs to — or who impersonates the advertiser address and SID of one already in use, periodic advertising data being unauthenticated — can change the BASE at will; each new BASE is re-parsed. A crafted BASE therefore writes attacker-chosen bytes past the end of a fixed static object in .bss: up to roughly 236 bytes for an oversized metadata LTV, plus whole struct bt_bap_bass_subgroup records for each subgroup beyond CONFIG_BT_BAP_BASS_MAX_SUBGROUPS. This is memory corruption of adjacent Bluetooth-audio state reachable with no pairing, bonding or GATT connection, with a potential for remote code execution in the Bluetooth RX thread; in addition, the unvalidated metadata_len is forwarded to bt_bap_scan_delegator_mod_src(), which neither clamps it nor rejects it, leading to a further copy into the receive state and to out-of-bounds memory being disclosed in the BASS receive-state notification sent to a connected Broadcast Assistant. The fix rejects a BASE carrying more subgroups than the receive state can hold (discarding the update entirely) and omits metadata that does not fit rather than copying it, and additionally honours the previously-ignored error return of the subgroup decode pass.

Dane podatności pochodzą z NVD (NIST) · CISA KEV · EPSS