CVE-2024-43770: Google Android RCE Vulnerability

CVE-2024-43770 Overview

CVE-2024-43770 is an out-of-bounds write vulnerability in the Android Bluetooth stack, specifically in the gatts_process_find_info function of gatt_sr.cc. The flaw stems from a missing bounds check when the Generic Attribute Profile (GATT) server processes Find Information requests. An attacker within Bluetooth range can trigger the condition without user interaction, potentially achieving remote code execution on the target device. Google disclosed the issue in the January 2025 Android Security Bulletin, and it affects Android versions 12 through 15. The vulnerability is tracked under [CWE-94] (Improper Control of Generation of Code).

Critical Impact
Proximity-based remote code execution over Bluetooth against Android 12 through 15 devices, requiring no user interaction and no additional privileges.

Affected Products

Google Android 12.0 and 12.1
Google Android 13.0 and 14.0
Google Android 15.0

Discovery Timeline

2025-01-21 - CVE-2024-43770 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43770

Vulnerability Analysis

The vulnerability resides in gatts_process_find_info, a handler in the Bluetooth GATT server implementation (gatt_sr.cc). GATT is the protocol layer that governs attribute discovery and access over Bluetooth Low Energy (BLE). The Find Information procedure lets a client enumerate attribute handles and their UUID types within a specified handle range.

When the server assembles the response, it writes attribute descriptors into a fixed-size buffer without validating the destination bounds. A crafted request can drive the write past the buffer boundary, corrupting adjacent memory in the Bluetooth process. Successful exploitation can redirect execution flow within the privileged Bluetooth daemon, yielding remote code execution over an adjacent network path.

Root Cause

The root cause is a missing bounds check on the destination buffer used to serialize Find Information responses. The handler trusts client-controlled handle ranges when deciding how many descriptor entries to emit, and it does not verify that the accumulated write length remains within the response buffer size. This is an out-of-bounds write conforming to [CWE-94] as classified by Google.

Attack Vector

Exploitation requires only Bluetooth adjacency to a vulnerable device. An attacker within radio range issues a malformed GATT Find Information request over an established or newly initiated BLE connection. Because the flaw is reachable pre-authentication and requires no user interaction, a paired or pairable device within range is sufficient to trigger the corruption.

No public proof-of-concept has been released, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. Technical mechanics are described in the Android Security Bulletin January 2025.

Detection Methods for CVE-2024-43770

Indicators of Compromise

Unexpected crashes or restarts of the com.android.bluetooth process in logcat and tombstone files.
Anomalous BLE peer devices initiating repeated GATT discovery operations against unpaired handsets.
Bluetooth HCI snoop logs showing malformed ATT Find Information requests with unusual handle ranges.

Detection Strategies

Enable Bluetooth HCI snoop logging on managed test devices and inspect ATT PDUs for oversized or overlapping handle ranges.
Monitor Android device telemetry for repeated Bluetooth stack crashes correlated with nearby unknown BLE peers.
Cross-reference installed Android security patch level against the January 2025 bulletin fix set in mobile device management (MDM) inventory.

Monitoring Recommendations

Ingest MDM and Android Enterprise device compliance data into a central analytics platform to flag devices missing the January 2025 patch level.
Alert on high-frequency Bluetooth process restarts in fleets where crash telemetry is available.
Track proximity-based anomalies in high-risk locations (executive travel, conferences) where BLE attack surface is elevated.

How to Mitigate CVE-2024-43770

Immediate Actions Required

Apply the January 2025 Android security patch level (2025-01-01 or later) to all Android 12, 12.1, 13, 14, and 15 devices.
Prioritize patch deployment for devices operated by high-risk users and any devices unable to enforce Bluetooth pairing restrictions.
Inventory unmanaged and BYOD Android devices to confirm vendor patch availability from OEMs and carriers.

Patch Information

Google released the fix as part of the Android Security Bulletin January 2025. Devices reporting a security patch level of 2025-01-01 or later contain the corrected bounds check in gatts_process_find_info. OEM-specific bulletins from device manufacturers should be consulted for vendor-supplied builds.

Workarounds

Disable Bluetooth on devices that cannot receive the patch, particularly in untrusted physical environments.
Restrict device discoverability and unpair unknown BLE peers to reduce the attack surface.
Enforce MDM policies that block Bluetooth or limit BLE peripherals on devices lacking the January 2025 patch level.

bash

# Verify Android security patch level on a device via ADB
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2025-01-01 or later