CVE-2024-49748: Google Android RCE Vulnerability

CVE-2024-49748 Overview

CVE-2024-49748 is a critical heap buffer overflow vulnerability in Google Android's Bluetooth GATT (Generic Attribute Profile) server implementation. The vulnerability exists in the gatts_process_primary_service_req function within gatt_sr.cc, where an out-of-bounds write condition can be triggered due to improper handling of heap-allocated buffers. This flaw enables remote code execution without requiring any user interaction or elevated privileges, making it particularly dangerous for affected Android devices.

Critical Impact

Remote attackers can achieve code execution on vulnerable Android devices via Bluetooth without any user interaction, potentially leading to complete device compromise including data theft, surveillance, and persistent access.

Affected Products

• Google Android 12.0
• Google Android 12.1
• Google Android 13.0
• Google Android 14.0
• Google Android 15.0

Discovery Timeline

• 2025-01-21 - CVE CVE-2024-49748 published to NVD
• 2025-04-22 - Last updated in NVD database

Technical Details for CVE-2024-49748

Vulnerability Analysis

The vulnerability resides in the Android Bluetooth stack's GATT server component, specifically within the gatts_process_primary_service_req function in the gatt_sr.cc source file. This function is responsible for processing incoming requests for primary Bluetooth services from connected devices.

The flaw is classified as CWE-787 (Out-of-bounds Write), indicating that the code writes data beyond the boundaries of an allocated heap buffer. In the context of Bluetooth GATT operations, when the server processes a malformed or specially crafted primary service request, insufficient bounds checking allows an attacker to overflow the heap buffer. This memory corruption can be leveraged to achieve arbitrary code execution with the privileges of the Bluetooth process.

The network attack vector combined with no authentication requirements makes this vulnerability exploitable by any attacker within Bluetooth range of a vulnerable device. The complete impact on confidentiality, integrity, and availability means a successful exploit could result in full device compromise.

Root Cause

The root cause of this vulnerability is improper validation of input data size in the gatts_process_primary_service_req function before writing to a heap-allocated buffer. When processing GATT primary service requests, the function fails to adequately verify that incoming data fits within the allocated buffer boundaries. This allows attacker-controlled data to overflow into adjacent heap memory regions, corrupting heap metadata and potentially overwriting function pointers or other critical data structures.

Attack Vector

The attack is executed over the network (Bluetooth) without requiring any privileges or user interaction. An attacker within Bluetooth range of a vulnerable Android device can send specially crafted GATT primary service requests that trigger the heap buffer overflow. The attack flow involves:

1. Establishing a Bluetooth connection with the target device
2. Initiating a GATT service discovery or attribute request
3. Sending malformed primary service request data that exceeds expected buffer boundaries
4. Exploiting the heap overflow to gain control of program execution
5. Executing arbitrary code with Bluetooth service privileges

The vulnerability is particularly concerning because Bluetooth is typically enabled by default on Android devices and requires no user approval for initial GATT protocol interactions.

Detection Methods for CVE-2024-49748

Indicators of Compromise

• Unusual Bluetooth activity or unexpected connection attempts from unknown devices
• Abnormal crashes or restarts of the Bluetooth service (com.android.bluetooth)
• Memory corruption indicators in Android system logs related to GATT operations
• Suspicious processes spawning from the Bluetooth service context

Detection Strategies

• Monitor Android system logs for repeated Bluetooth service crashes or ANR (Application Not Responding) events
• Deploy mobile threat detection solutions capable of identifying anomalous Bluetooth protocol behavior
• Implement network-level Bluetooth monitoring to detect malformed GATT requests
• Review device logs for gatt_sr.cc related errors or memory access violations

Monitoring Recommendations

• Enable verbose Bluetooth logging on enterprise-managed devices for forensic analysis
• Deploy SentinelOne Mobile Threat Defense to detect exploitation attempts and anomalous Bluetooth behavior
• Establish baseline Bluetooth connection patterns to identify suspicious activity
• Monitor for unauthorized code execution within the Bluetooth process context

How to Mitigate CVE-2024-49748

Immediate Actions Required

• Apply the January 2025 Android Security Patch immediately on all affected devices
• Disable Bluetooth on devices that cannot be immediately patched when not in active use
• Implement device management policies to enforce security updates
• Consider network segmentation and physical security measures to limit Bluetooth attack surface

Patch Information

Google has addressed this vulnerability in the Android Security Bulletin January 2025. Organizations should ensure all Android devices running versions 12.0 through 15.0 are updated to the January 2025 security patch level or later. The patch includes proper bounds checking in the gatts_process_primary_service_req function to prevent heap buffer overflows during GATT service request processing.

Workarounds

• Disable Bluetooth entirely on devices that cannot receive the security update
• Limit Bluetooth discoverability and pairing to trusted devices only
• Use Bluetooth only in trusted environments with physical access controls
• Deploy mobile device management (MDM) solutions to enforce Bluetooth usage policies on enterprise devices

# Android Debug Bridge commands for enterprise remediation
# Check current security patch level
adb shell getprop ro.build.version.security_patch

# Disable Bluetooth via ADB (requires appropriate permissions)
adb shell settings put global bluetooth_on 0

# Verify Bluetooth is disabled
adb shell settings get global bluetooth_on