CVE-2024-0016 Overview
CVE-2024-0016 is an out-of-bounds read vulnerability [CWE-125] in the Android Bluetooth module. The flaw exists in multiple locations where a missing bounds check allows an attacker to read memory outside the intended buffer. Successful exploitation discloses paired device information without requiring elevated privileges or user interaction. The vulnerability affects Android versions 11 through 14 and was addressed in the Android Security Bulletin for January 2024.
Critical Impact
Remote disclosure of paired Bluetooth device information without user interaction, enabling reconnaissance of nearby or previously connected devices on affected Android handsets.
Affected Products
- Google Android 11.0
- Google Android 12.0 and 12.1
- Google Android 13.0 and 14.0
Discovery Timeline
- 2024-01-01 - Fix published in the Android Security Bulletin January 2024
- 2024-02-16 - CVE-2024-0016 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0016
Vulnerability Analysis
The vulnerability resides in the Android Bluetooth module packaged with the platform. Several code paths process paired-device data structures without validating buffer boundaries before reading. An attacker within Bluetooth range or through a crafted network-reachable interaction can trigger the parsing path and cause the module to read adjacent memory. Because the disclosed data can include information about paired devices, the flaw supports reconnaissance of a victim's Bluetooth ecosystem. Exploitation does not require user interaction and does not require elevated privileges on the target device.
Root Cause
The root cause is a missing bounds check in multiple locations within the Bluetooth stack. When the affected functions read from a paired-device data structure, they do not verify that the requested offset or length falls within the allocated buffer. This is a classic [CWE-125] out-of-bounds read condition, in which the code trusts input-derived sizes or indices without validation.
Attack Vector
The attack vector is network-adjacent through the Bluetooth interface exposed by the Android stack. An attacker crafts inputs that cause the vulnerable parsing routine to read beyond the intended buffer. The confidentiality impact is limited to information disclosure; the flaw does not modify data or crash the device. Attackers can chain the leaked information with other Bluetooth-facing vulnerabilities to profile targets or improve success rates for follow-on attacks.
The upstream fix is available in the Android Bluetooth module update, which introduces the missing bounds validation.
Detection Methods for CVE-2024-0016
Indicators of Compromise
- Unexpected Bluetooth pairing queries or scan activity originating from unknown devices in proximity to affected handsets.
- Anomalous Bluetooth service interactions with fields containing unusually large offsets or lengths.
- Fleet devices reporting Android security patch levels earlier than 2024-01-01 with Bluetooth active.
Detection Strategies
- Inventory Android endpoints by security patch level and flag devices below the January 2024 patch as exposed to CVE-2024-0016.
- Correlate MDM telemetry with Bluetooth activity logs to identify unpatched devices operating in high-risk environments.
- Monitor for repeated Bluetooth pairing attempts or malformed L2CAP or profile-level requests from the same MAC address.
Monitoring Recommendations
- Ingest Android device posture and patch-level attributes into your SIEM and alert on drift from the enforced baseline.
- Track mobile threat defense signals for suspicious Bluetooth activity, particularly in shared workspaces and travel scenarios.
- Review executive and high-risk user devices for compliance with the January 2024 Android security patch level.
How to Mitigate CVE-2024-0016
Immediate Actions Required
- Apply the January 2024 Android security patch or later to all managed Android 11, 12, 12.1, 13, and 14 devices.
- Enforce a minimum patch level policy through your Mobile Device Management (MDM) platform and block noncompliant devices from sensitive resources.
- Prioritize patching for devices used by high-risk users and those regularly operating in public spaces.
Patch Information
Google addressed CVE-2024-0016 in the Android Security Bulletin January 2024. The code-level fix is committed in the Bluetooth module at revision 1d7ba7c8a205522f384e8d5c7c9f26a421cab5f1 and is available through the Android Bluetooth module update. Device vendors distribute the fix through their standard OTA channels; verify vendor-specific patch availability for non-Pixel devices.
Workarounds
- Disable Bluetooth on affected devices when not in use, particularly in untrusted environments, until the patch is applied.
- Remove stale paired-device entries to reduce the volume of information exposed by the out-of-bounds read.
- Restrict use of unpatched devices for handling sensitive data through conditional access policies.
# Query Android security patch level via ADB to identify exposed devices
adb shell getprop ro.build.version.security_patch
# Devices reporting a value earlier than 2024-01-01 are exposed to CVE-2024-0016
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
