CVE-2024-34722 Overview
CVE-2024-34722 is an authentication bypass vulnerability in the Android Bluetooth stack. The flaw resides in the smp_proc_rand function of smp_act.cc, part of the Security Manager Protocol (SMP) implementation used during legacy Bluetooth Low Energy (BLE) pairing. Incorrect protocol implementation allows an adjacent attacker to bypass authentication during pairing. Successful exploitation leads to remote privilege escalation without requiring user interaction or additional execution privileges. The vulnerability affects Android versions 12, 12L, 13, and 14. Google addressed the issue in the Android Security Bulletin dated July 2024, with additional references in the January 2025 bulletin.
Critical Impact
An adjacent attacker within Bluetooth range can bypass legacy BLE pairing authentication and escalate privileges on affected Android devices without any user interaction.
Affected Products
- Google Android 12.0
- Google Android 12.1 (12L)
- Google Android 13.0
- Google Android 14.0
Discovery Timeline
- 2024-07-09 - CVE-2024-34722 published to the National Vulnerability Database (NVD)
- 2024-07-01 - Fix referenced in the Android Security Bulletin July 2024
- 2025-01-01 - Additional reference in the Android Security Bulletin January 2025
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-34722
Vulnerability Analysis
The vulnerability is classified as an authentication bypass ([CWE-303]: Incorrect Implementation of Authentication Algorithm) in the Android Bluetooth module. It affects the Security Manager Protocol (SMP), which negotiates keys and authenticates peers during BLE pairing. The defect lives in smp_proc_rand, the handler responsible for processing the peer's random value exchanged during the pairing confirm/random phase of legacy pairing.
During legacy BLE pairing, both peers exchange confirm values derived from a temporary key (TK), followed by random values used to verify the earlier confirm. If the confirm-versus-computed value check is not enforced correctly, an attacker can complete pairing without proving knowledge of the TK. The improper implementation in smp_proc_rand allows this state transition to succeed even when the cryptographic verification should fail.
Root Cause
The root cause is an incorrect implementation of the legacy pairing protocol's confirm-value verification step. The upstream fix is available in the Android Bluetooth module commit 456f705b9acc78d8184536baff3d21b0bc11c957, which corrects the handling within smp_proc_rand. See the Android Bluetooth Module Commit for the source-level change.
Attack Vector
Exploitation requires the attacker to be within Bluetooth radio range of a target Android device that is discoverable or actively pairing over legacy BLE. The attacker initiates or intercepts the pairing exchange and manipulates the confirm and random values sent to the target. Because the protocol check is not enforced correctly, pairing completes and the attacker obtains an authenticated relationship with the victim device. No user interaction is needed on the target during exploitation. Consult the Android Security Bulletin 2024-07-01 for vendor guidance on affected components.
Detection Methods for CVE-2024-34722
Indicators of Compromise
- Unexpected BLE bonding entries in /data/misc/bluedroid/bt_config.conf or the equivalent bond store on Android devices.
- Bluetooth HCI logs showing repeated legacy pairing attempts from unknown peers within a short time window.
- Newly registered GATT clients or paired peripherals that were not initiated by the device user.
- Anomalous SMP Pairing Random (opcode 0x04) exchanges without a matching legitimate user pairing action.
Detection Strategies
- Enable and collect Android Bluetooth HCI snoop logs from fleet devices, then inspect for SMP pairing sequences that complete without corresponding user-initiated pairing UI events.
- Monitor Mobile Device Management (MDM) telemetry for new Bluetooth bonds created on managed devices and correlate with user activity.
- Alert on Android devices reporting build fingerprints predating the July 2024 or January 2025 security patch level in enterprise inventories.
Monitoring Recommendations
- Track the ro.build.version.security_patch property across the mobile fleet and flag devices below 2024-07-01.
- Log and review Bluetooth pairing events surfaced through MDM or Android Enterprise APIs.
- Correlate physical location and Bluetooth activity for high-value users to identify proximity-based pairing attempts.
How to Mitigate CVE-2024-34722
Immediate Actions Required
- Apply the Android security patch level 2024-07-01 or later to all devices running Android 12, 12L, 13, and 14.
- Disable Bluetooth on unpatched devices when it is not required, particularly in untrusted physical environments.
- Remove unknown or unnecessary bonded devices from the Bluetooth settings on managed endpoints.
- Enforce security patch level compliance through MDM policy and block noncompliant devices from corporate resources.
Patch Information
Google released the fix through the Android Security Bulletin 2024-07-01, with the underlying code change published in the Android Bluetooth Module Commit. Additional context is provided in the Android Security Bulletin 2025-01-01. Device manufacturers ship the patch through their monthly security update channels; users should install the latest OEM update that includes the July 2024 patch level or newer.
Workarounds
- Turn off Bluetooth on the device when it is not actively in use, especially in public or hostile environments.
- Avoid pairing with unknown BLE peripherals and reject unexpected pairing prompts.
- Set Bluetooth visibility to non-discoverable and initiate pairing only in trusted locations.
- For enterprise deployments, restrict Bluetooth usage via MDM policy on devices that cannot yet receive the vendor patch.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
