CVE-2024-0039: Google Android RCE Vulnerability

CVE-2024-0039 Overview

CVE-2024-0039 is a critical out-of-bounds write vulnerability discovered in the Android Bluetooth stack, specifically in the attp_build_value_cmd function within att_protocol.cc. This vulnerability allows remote attackers to execute arbitrary code on affected Android devices without requiring any user interaction or special privileges.

The flaw exists due to a missing bounds check in the Attribute Protocol (ATT) implementation, which handles Bluetooth Low Energy (BLE) communications. When processing specially crafted ATT packets, the vulnerable function fails to validate input boundaries, allowing an attacker to write data beyond allocated buffer limits.

Critical Impact

Remote code execution on Android devices via Bluetooth without user interaction, potentially allowing complete device compromise including data theft, surveillance, and malware installation.

Affected Products

• Google Android 12.0
• Google Android 12.1
• Google Android 13.0
• Google Android 14.0

Discovery Timeline

• 2024-03-01 - Google releases security patches in Android Security Bulletin March 2024
• 2024-03-11 - CVE-2024-0039 published to NVD
• 2025-03-13 - Last updated in NVD database

Technical Details for CVE-2024-0039

Vulnerability Analysis

The vulnerability resides in the attp_build_value_cmd function within the Android Bluetooth stack's ATT protocol implementation (att_protocol.cc). This function is responsible for constructing ATT protocol data units (PDUs) used in Bluetooth Low Energy communications.

The core issue is a missing bounds check when building value commands for ATT operations. When the function processes incoming data to construct ATT PDUs, it fails to properly validate that the data length does not exceed the allocated buffer size. This allows an attacker to supply malicious input that causes the function to write beyond the buffer's boundaries.

The vulnerability is classified as CWE-787 (Out-of-Bounds Write), one of the most dangerous memory corruption vulnerability types. Because the Android Bluetooth daemon runs with elevated privileges and processes network-originated data, successful exploitation can lead to complete device compromise.

Root Cause

The root cause is a missing bounds validation in the attp_build_value_cmd function. The function constructs ATT protocol messages by copying data into a fixed-size buffer without first verifying that the source data length fits within the destination buffer's capacity.

In C/C++ code, this typically manifests as a memcpy or similar memory operation where the size parameter is derived from attacker-controlled input without proper sanitization. The absence of a length check before the copy operation allows heap or stack memory corruption depending on the buffer's allocation location.

Attack Vector

The attack vector is network-based, requiring the attacker to be within Bluetooth range of the target device. The attack flow involves:

1. The attacker establishes a Bluetooth Low Energy connection with the target Android device
2. During the ATT protocol handshake or subsequent communication, the attacker sends specially crafted ATT packets
3. The malformed packets contain oversized data that triggers the out-of-bounds write in attp_build_value_cmd
4. The memory corruption can be leveraged to overwrite critical data structures or inject executable code
5. Code execution occurs in the context of the Bluetooth daemon process

Because no user interaction is required and Bluetooth is often enabled by default on mobile devices, this vulnerability represents a significant threat to any Android device within radio range of an attacker.

The vulnerability can be exploited by sending malformed ATT protocol packets that contain data exceeding expected buffer sizes. When the attp_build_value_cmd function processes these packets, it performs a memory write operation without validating that the write offset and length remain within the allocated buffer boundaries. This allows an attacker to corrupt adjacent memory regions, potentially overwriting function pointers, return addresses, or other security-critical data structures. For detailed technical information, see the Android Bluetooth Change Log.

Detection Methods for CVE-2024-0039

Indicators of Compromise

• Unusual Bluetooth Low Energy connection attempts from unknown devices
• Bluetooth daemon crashes or unexpected restarts in system logs
• Anomalous memory allocation patterns in the com.android.bluetooth process
• Signs of privilege escalation or unauthorized process spawning following Bluetooth activity

Detection Strategies

• Monitor Android system logs for Bluetooth-related crash reports or ANR (Application Not Responding) events in the Bluetooth stack
• Implement network-based Bluetooth traffic analysis to detect malformed ATT protocol packets
• Deploy mobile threat defense solutions capable of identifying exploitation attempts targeting the Bluetooth subsystem
• Review device security patch levels to identify unpatched devices in your environment

Monitoring Recommendations

• Enable verbose logging for Bluetooth services during security investigations
• Implement mobile device management (MDM) policies to track security patch compliance
• Set up alerts for unexpected Bluetooth daemon behavior or service crashes
• Monitor for new device pairings or connection attempts, especially in sensitive environments

How to Mitigate CVE-2024-0039

Immediate Actions Required

• Apply the March 2024 Android security patch immediately on all affected devices
• Disable Bluetooth on devices that cannot be patched immediately, especially in high-risk environments
• Ensure devices are set to non-discoverable mode when Bluetooth must remain enabled
• Review and remove unused Bluetooth pairings from affected devices

Patch Information

Google addressed this vulnerability in the March 2024 Android Security Bulletin. The fix adds proper bounds checking to the attp_build_value_cmd function to ensure data lengths are validated before memory operations. Multiple patches have been committed to the Android Bluetooth module repository to address this issue across different Android versions.

Patch references:

• Android Bluetooth patch commit 015c618
• Android Bluetooth patch commit 17044cc
• Android Bluetooth patch commit f0f3527

For complete patch details, see the Android Security Bulletin March 2024.

Workarounds

• Disable Bluetooth completely on unpatched devices when not actively in use
• Use mobile device management (MDM) to enforce Bluetooth policies and restrict discoverability
• Implement network segmentation to isolate devices that cannot be immediately patched
• Consider deploying mobile threat defense solutions that can detect Bluetooth-based attack attempts

# Disable Bluetooth via ADB for enterprise-managed devices
adb shell settings put global bluetooth_on 0
adb shell svc bluetooth disable

# Check current Android security patch level
adb shell getprop ro.build.version.security_patch
# Should return 2024-03-01 or later for patched devices