The SEND_RESPONSE_TRANSACTION and SEND_NOTIFICATION_TRANSACTION IPC calls in BnBluetoothGattServer:nTransact are vulnerable to stack corruption which could allow an attacker to locally elevate privileges to the level of the bluetooth service. Continue reading...
