CVE-2024-43771
Published: 21 January 2025
Description
In gatts_process_read_req of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Security Summary
CVE-2024-43771 is a vulnerability in the gatts_process_read_req function of gatt_sr.cc, part of Android's Bluetooth stack, stemming from a missing bounds check that enables an out-of-bounds write. This flaw affects Android devices with Bluetooth enabled, particularly those processing GATT (Generic Attribute Profile) read requests in the Bluetooth Low Energy (BLE) server component.
Attackers in proximal or adjacent physical range (e.g., Bluetooth proximity) can exploit this remotely without requiring authentication privileges or user interaction. Successful exploitation leads to arbitrary code execution with the permissions of the Bluetooth process, potentially resulting in high-impact confidentiality, integrity, and availability compromises, as indicated by the CVSS v3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue maps to CWE-94 (Code Injection).
The Android Security Bulletin for January 2025 at https://source.android.com/security/bulletin/2025-01-01 provides details on affected versions and patches. Security practitioners should apply the recommended updates to mitigate exploitation risks.
Details
- CWE(s)