CVE-2023-40129 Overview
CVE-2023-40129 is a heap buffer overflow in the build_read_multi_rsp function of gatt_sr.cc within the Android Bluetooth stack. The flaw allows an attacker within Bluetooth range to trigger an out-of-bounds write on the target device. Exploitation requires no user interaction and no additional execution privileges, enabling remote code execution from an adjacent attacker. Google patched the issue in the October 2023 Android Security Bulletin, with fixes landing in the Bluetooth module via commit c0151aa3ba76c785b32c7f9d16c98febe53017b1. The vulnerability is tracked under [CWE-787: Out-of-bounds Write].
Critical Impact
An attacker within Bluetooth proximity can achieve remote code execution on affected Android 12, 12.1, and 13 devices without user interaction.
Affected Products
- Google Android 12.0
- Google Android 12.1
- Google Android 13.0
Discovery Timeline
- 2023-10-27 - CVE-2023-40129 published to the National Vulnerability Database (NVD)
- 2023-10-01 - Google releases fix in the Android Security Bulletin
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2023-40129
Vulnerability Analysis
The defect resides in build_read_multi_rsp, a Bluetooth Generic Attribute Profile (GATT) server routine that assembles responses to a Read Multiple Characteristics request. The function writes attribute values into a response buffer without correctly validating that the cumulative payload fits within the allocated heap region. When the combined size of the requested attributes exceeds the destination buffer, the function performs an out-of-bounds write into adjacent heap memory.
Because the Bluetooth daemon runs with elevated privileges on Android, corrupting heap structures in this process gives an attacker a direct path to code execution within the Bluetooth subsystem. The attack vector is adjacent network (Bluetooth radio range), and no authentication or user interaction is required. The Android Bluetooth module fix can be reviewed in the upstream patch commit.
Root Cause
The root cause is missing length validation when concatenating multiple GATT attribute values into a single response. The handler trusts the attribute sizes reported by internal lookups and appends them sequentially. Bounds checks against the response buffer length are absent or incomplete, producing the heap buffer overflow described in [CWE-787].
Attack Vector
An attacker within Bluetooth range pairs or interacts with a vulnerable device that has Bluetooth enabled. The attacker sends a crafted ATT_READ_MULTI_REQ GATT request referencing attribute handles whose combined values exceed the destination buffer. The vulnerable function copies the values past the buffer boundary, corrupting heap metadata and enabling control-flow hijacking inside the Bluetooth process.
No verified public exploit code is available for CVE-2023-40129. Technical details are available in the Android Security Bulletin October 2023.
Detection Methods for CVE-2023-40129
Indicators of Compromise
- Unexpected crashes or restarts of the com.android.bluetooth process recorded in logcat or tombstone files
- SIGSEGV or heap corruption tombstones referencing build_read_multi_rsp or gatt_sr.cc frames
- Anomalous incoming GATT Read Multiple requests from unpaired or unknown Bluetooth peers
Detection Strategies
- Monitor Android device logs and crash reports for repeated Bluetooth stack faults that correlate with nearby unknown devices
- Inspect Host Controller Interface (HCI) traces or btsnoop logs for malformed or oversized GATT read-multiple requests
- Enforce mobile device management (MDM) policies that flag Android 12, 12.1, and 13 devices missing the October 2023 security patch level
Monitoring Recommendations
- Centralize mobile crash telemetry and tombstones for triage by the security operations team
- Track Android patch level (ro.build.version.security_patch) across the fleet and alert on devices below 2023-10-01
- Capture Bluetooth pairing and connection events from enterprise endpoints to identify proximity-based attack attempts
How to Mitigate CVE-2023-40129
Immediate Actions Required
- Apply the October 2023 Android security patch or later on all Android 12, 12.1, and 13 devices
- Disable Bluetooth on devices that cannot be patched, particularly in high-risk physical environments
- Restrict pairing and discoverability to trusted devices only and revoke unused bonded peers
Patch Information
Google addressed CVE-2023-40129 in the Android Security Bulletin October 2023. The corresponding source fix is published in the Android Bluetooth module commit. Devices must be on security patch level 2023-10-05 or later to be considered remediated.
Workarounds
- Turn Bluetooth off when not in active use, especially in public or untrusted locations
- Set the device to non-discoverable mode and remove stale bonded devices from the paired list
- Use enterprise mobility management to enforce a minimum Android security patch level for network access
# Verify Android security patch level on a device via adb
adb shell getprop ro.build.version.security_patch
# Expected output: 2023-10-05 or later for CVE-2023-40129 remediation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
