CVE-2024-43771 Overview
CVE-2024-43771 is an out-of-bounds write vulnerability in the Android Bluetooth stack. The flaw resides in the gatts_process_read_req function of gatt_sr.cc, where a missing bounds check permits memory corruption during Generic Attribute Profile (GATT) read request processing. An attacker within Bluetooth range can trigger remote code execution without user interaction and without additional privileges. The vulnerability affects Android versions 12 through 15 and is addressed in the Android Security Bulletin January 2025.
Critical Impact
Proximal attackers can achieve remote code execution on unpatched Android devices with no user interaction, exposing the device kernel-adjacent Bluetooth subsystem to full compromise.
Affected Products
- Google Android 12.0 and 12.1
- Google Android 13.0 and 14.0
- Google Android 15.0
Discovery Timeline
- 2025-01-21 - CVE-2024-43771 published to the National Vulnerability Database (NVD)
- 2025-01-01 - Google publishes fix in the Android Security Bulletin January 2025
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-43771
Vulnerability Analysis
The vulnerability affects the gatts_process_read_req routine inside gatt_sr.cc, part of the Android Bluetooth GATT server implementation. GATT is the protocol used by Bluetooth Low Energy (BLE) devices to exchange attribute data. When a peer device issues a read request, the server processes the request and prepares a response containing the requested attribute value.
A missing bounds check in this handler allows attacker-controlled data to be written past the end of a destination buffer. This writes out-of-bounds memory inside the Bluetooth process, corrupting adjacent structures. The classification CWE-94 (improper control of generated code) reflects that memory corruption in this control path can be steered into code execution.
Root Cause
The root cause is the absence of a length or offset validation before copying data into a fixed-size buffer during GATT read request handling. Because the check is missing prior to the write, an attacker crafting an oversized or offset-manipulated attribute request can overflow the target buffer. The Bluetooth daemon on Android runs with sensitive system privileges, magnifying the impact.
Attack Vector
The attack requires adjacency, meaning the attacker must be within Bluetooth range of the target device. No pairing, authentication, or user interaction is required. An attacker sends a malformed GATT read request to a vulnerable Android device with Bluetooth enabled. Successful exploitation results in remote code execution inside the Bluetooth process context. This vector is well suited to opportunistic attacks in crowded environments such as transit hubs, offices, and conferences.
No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical exploitation details are described in prose here because no verified public code has been released. See the Android Security Bulletin January 2025 for vendor-provided technical context.
Detection Methods for CVE-2024-43771
Indicators of Compromise
- Unexpected crashes or restarts of the com.android.bluetooth process on Android 12 through 15 devices
- Kernel or tombstone logs referencing gatts_process_read_req or gatt_sr.cc faults
- Unsolicited GATT read requests originating from unknown BLE peers in enterprise Bluetooth telemetry
Detection Strategies
- Collect Android bug reports and tombstones from managed devices and search for Bluetooth stack signal-11 (SIGSEGV) faults in the GATT server path
- Monitor mobile device management (MDM) fleet reports for devices running pre-January 2025 security patch levels
- Correlate Bluetooth scanning activity in physical proximity to executives and high-value users using enterprise BLE detection sensors
Monitoring Recommendations
- Enforce reporting of Android security patch level (ro.build.version.security_patch) through MDM and flag any device predating 2025-01-01
- Alert on repeated Bluetooth process crash loops which may indicate exploitation attempts or reliability probing
- Track BLE advertising and connection attempts near sensitive facilities using wireless intrusion detection
How to Mitigate CVE-2024-43771
Immediate Actions Required
- Install the Android security patch level 2025-01-01 or later on all affected Android 12, 12.1, 13, 14, and 15 devices
- Disable Bluetooth on devices that cannot be patched immediately, particularly in public or high-risk locations
- Enforce patch compliance through MDM policy and block corporate resource access from non-compliant devices
Patch Information
Google addressed CVE-2024-43771 in the Android Security Bulletin January 2025. Original equipment manufacturers (OEMs) integrate the fix into their respective device builds. Users must apply the vendor-supplied over-the-air (OTA) update that reports a security patch level of 2025-01-01 or later. Devices no longer receiving vendor security updates remain permanently exposed.
Workarounds
- Turn off Bluetooth when not actively in use, especially in untrusted physical environments
- Set Bluetooth to non-discoverable and disable BLE peripheral or GATT server functionality where the device role allows
- Restrict high-risk users to devices actively receiving monthly Android security updates
# Verify Android security patch level on a device via ADB
adb shell getprop ro.build.version.security_patch
# A compliant device should return 2025-01-01 or later
# Disable Bluetooth from the command line as a temporary workaround
adb shell svc bluetooth disable
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
