CVE-2024-0045 Overview
CVE-2024-0045 is an out-of-bounds read vulnerability in the Android Bluetooth stack. The flaw resides in the smp_proc_sec_req function within smp_act.cc, part of the Security Manager Protocol (SMP) implementation. Improper input validation allows an attacker within Bluetooth range to read adjacent memory contents. Exploitation requires no user interaction and no additional execution privileges. Successful exploitation results in information disclosure from the device. The vulnerability affects Android versions 12.0, 12.1, 13.0, and 14.0, as tracked by Google in the March 2024 Android Security Bulletin.
Critical Impact
An adjacent-network attacker can trigger an out-of-bounds read in the Bluetooth SMP handler to disclose sensitive memory contents without user interaction.
Affected Products
- Google Android 12.0
- Google Android 12.1
- Google Android 13.0 and 14.0
Discovery Timeline
- 2024-03-11 - CVE-2024-0045 published to the National Vulnerability Database (NVD)
- 2024-03-01 - Fix included in the Android Security Bulletin March 2024
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0045
Vulnerability Analysis
The vulnerability exists in smp_proc_sec_req, a handler in the Bluetooth Security Manager Protocol (SMP) implementation located in packages/modules/Bluetooth/system/stack/smp/smp_act.cc. The function processes inbound SMP Security Request Protocol Data Units (PDUs) exchanged during Bluetooth Low Energy (BLE) pairing and bonding.
The defect is classified as an out-of-bounds read [CWE-125] caused by improper input validation [CWE-20]. When the SMP handler processes a malformed or truncated security request, it reads past the end of the intended buffer. The disclosed bytes may contain sensitive process memory adjacent to the SMP packet buffer.
Because the Bluetooth stack processes these PDUs automatically during pairing operations, no user interaction is required. The attack surface is limited to devices within Bluetooth radio range.
Root Cause
The root cause is missing or incorrect length validation of an inbound SMP Security Request PDU before the handler dereferences fields inside the packet. The upstream fix in commit 7d0f696f450241d8ba7a168ba14fa7b75032f0c9 corrects the boundary check in the Google Bluetooth module.
Attack Vector
Exploitation requires the attacker to be within Bluetooth range of a vulnerable Android device with Bluetooth enabled. The attacker sends a crafted SMP Security Request over an L2CAP SMP channel targeting a device that supports BLE pairing. The vulnerable handler processes the malformed request and returns memory contents to the attacker as part of the SMP exchange or through observable side effects. No authentication or existing bond is required.
Code examples are not published for this vulnerability. Refer to the vendor patch for the exact conditions and corrective validation logic.
Detection Methods for CVE-2024-0045
Indicators of Compromise
- Unexpected BLE pairing attempts from unknown devices logged in logcat under the bluetooth tag
- Repeated malformed SMP Security Request PDUs observed on the L2CAP SMP channel (CID 0x0006)
- Bluetooth service crashes or restarts (com.android.bluetooth) coinciding with proximity of an unknown radio source
Detection Strategies
- Monitor Android security patch level via Mobile Device Management (MDM) and flag devices below the 2024-03-01 patch level
- Capture and inspect Bluetooth HCI snoop logs on high-value devices to identify anomalous SMP traffic patterns
- Correlate proximity-based Bluetooth scan events with unexpected pairing requests on managed endpoints
Monitoring Recommendations
- Ingest Android device compliance and patch-level telemetry into a central Security Information and Event Management (SIEM) platform
- Alert on devices that remain unpatched past the vendor-recommended remediation window
- Track Bluetooth-related crash reports and service restarts across the managed mobile fleet
How to Mitigate CVE-2024-0045
Immediate Actions Required
- Apply the Android security patch level 2024-03-01 or later on all affected devices
- Disable Bluetooth on devices that cannot be updated when it is not actively required
- Enforce a minimum patch level policy through MDM to block non-compliant devices from corporate resources
Patch Information
Google addressed the vulnerability in the March 2024 Android Security Bulletin. The upstream fix is committed to the Android Open Source Project (AOSP) Bluetooth module at commit 7d0f696f450241d8ba7a168ba14fa7b75032f0c9. Original Equipment Manufacturers (OEMs) distribute the corrected code through their monthly security updates. Verify remediation by confirming the device reports a security patch level of 2024-03-01 or later under Settings > About phone > Android version.
Workarounds
- Turn off Bluetooth in Settings when the radio is not needed, particularly in untrusted environments
- Avoid placing unpatched devices in high-density public areas where adjacent-network attacks are feasible
- Restrict device discoverability and reject pairing requests from unknown peers
# Verify Android security patch level on a connected device via ADB
adb shell getprop ro.build.version.security_patch
# Expected output: 2024-03-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
