CVE-2024-43096 Overview
CVE-2024-43096 is an out-of-bounds write vulnerability in the Android Bluetooth stack. The flaw resides in the build_read_multi_rsp function of gatt_sr.cc, where a missing bounds check allows memory corruption during Generic Attribute Profile (GATT) response construction. An attacker within Bluetooth range can trigger the flaw to achieve remote code execution without user interaction and without additional execution privileges. Google addressed the vulnerability in the Android Security Bulletin January 2025. The vulnerability affects Android versions 12 through 15, exposing a broad segment of the active device population.
Critical Impact
Adjacent attackers can execute arbitrary code on affected Android devices over Bluetooth without user interaction, potentially compromising the entire device.
Affected Products
- Google Android 12.0 and 12.1
- Google Android 13.0 and 14.0
- Google Android 15.0
Discovery Timeline
- 2025-01-21 - CVE-2024-43096 published to the National Vulnerability Database
- 2025-01-01 - Google publishes fix in the Android Security Bulletin
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-43096
Vulnerability Analysis
The vulnerability is an out-of-bounds write [CWE-787] in the Android Bluetooth GATT server implementation. The build_read_multi_rsp function in gatt_sr.cc constructs responses to GATT Read Multiple requests. A missing bounds check allows response data to be written past the boundaries of the destination buffer.
GATT operates over Bluetooth Low Energy (BLE) and handles attribute reads across paired and unpaired peers. When a device within Bluetooth range issues a crafted Read Multiple request, the server-side response builder writes attribute data without validating the target buffer size. This memory corruption can be steered toward remote code execution in the Bluetooth process context.
Exploitation requires no user interaction and no prior authentication. The attacker must be within radio range of the target device, classifying the attack as adjacent network.
Root Cause
The root cause is a missing length validation before writing multi-attribute response data into a response buffer inside build_read_multi_rsp. When aggregate attribute payloads exceed the allocated buffer capacity, the write operation crosses the buffer boundary and corrupts adjacent memory structures.
Attack Vector
An attacker within Bluetooth range sends a specially crafted GATT Read Multiple request targeting attributes whose combined values overflow the response buffer. The server processes the request, invokes build_read_multi_rsp, and writes past buffer bounds. The resulting corruption can be shaped to hijack control flow within the Bluetooth stack, leading to code execution.
Refer to the Android Security Bulletin January 2025 for vendor technical details and patch metadata.
Detection Methods for CVE-2024-43096
Indicators of Compromise
- Unexpected Bluetooth service crashes or restarts on Android devices, particularly in com.android.bluetooth.
- Kernel or system logs referencing faults inside gatt_sr or GATT Read Multiple handlers.
- Anomalous BLE pairing attempts or repeated GATT read operations from unknown peers in proximity.
Detection Strategies
- Monitor Android system logs (logcat) for repeated tombstone entries and native crashes referencing the Bluetooth process.
- Aggregate mobile device telemetry to identify clusters of Bluetooth stack instability across a fleet, which may indicate active probing.
- Correlate mobile threat defense alerts with proximity-based anomalous BLE activity in sensitive physical locations.
Monitoring Recommendations
- Enforce mobile device management (MDM) policies that report Android patch level and flag devices below the January 2025 security patch level.
- Track Bluetooth-related process crashes as security events, not just reliability signals.
- Restrict Bluetooth usage in high-risk environments and monitor for unauthorized BLE peripheral scanning.
How to Mitigate CVE-2024-43096
Immediate Actions Required
- Apply the January 2025 Android security patch level (2025-01-01 or later) on all affected devices.
- Prioritize patching for devices operating in public or high-density environments where Bluetooth exposure is greatest.
- Inventory Android 12 through 15 devices across the organization and confirm vendor patch availability from device OEMs.
Patch Information
Google released a fix as part of the Android Security Bulletin January 2025. Device manufacturers integrate the fix into OEM firmware updates. Confirm patch level in Settings > About phone > Android security update and ensure the value is 2025-01-01 or later.
Workarounds
- Disable Bluetooth on devices that cannot be immediately updated, especially when in untrusted environments.
- Enforce MDM policies that restrict Bluetooth to paired accessories only and disable discoverability.
- Segregate unpatched devices from sensitive workloads and data until the vendor patch is applied.
# Verify Android security patch level via adb
adb shell getprop ro.build.version.security_patch
# Expected output: 2025-01-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
