CVE-2024-49748: Google Android RCE Vulnerability

CVE-2024-49748 Overview

CVE-2024-49748 is a heap buffer overflow vulnerability in the Android Bluetooth stack. The flaw resides in the gatts_process_primary_service_req function within gatt_sr.cc, part of the Generic Attribute Profile (GATT) server implementation. An attacker within Bluetooth range can trigger an out-of-bounds write that leads to remote code execution. Exploitation requires no user interaction and no additional execution privileges. Google addressed the issue in the Android Security Bulletin January 2025. Affected versions span Android 12 through Android 15.

Critical Impact
Remote code execution on affected Android devices through a proximate Bluetooth attack vector with zero user interaction.

Affected Products

Google Android 12.0 and 12.1
Google Android 13.0 and 14.0
Google Android 15.0

Discovery Timeline

2025-01-21 - CVE-2024-49748 published to NVD
2025-01-01 - Google releases fix in Android Security Bulletin
2025-04-22 - Last updated in NVD database

Technical Details for CVE-2024-49748

Vulnerability Analysis

The vulnerability is a heap-based out-of-bounds write [CWE-787] in the Android Bluetooth GATT server. The gatts_process_primary_service_req function handles incoming GATT requests for primary service discovery. Improper bounds checking when processing attacker-supplied service request data allows writes beyond the allocated heap buffer. An attacker controlling adjacent heap memory can corrupt object metadata or function pointers to redirect execution. The Bluetooth daemon runs with elevated privileges, making successful exploitation a path to system-level code execution. EPSS data places this issue in the 90th percentile for likelihood of exploitation.

Root Cause

The root cause is missing or insufficient length validation on attacker-influenced fields parsed by gatts_process_primary_service_req in gatt_sr.cc. The function processes service discovery requests without enforcing that input sizes remain within the bounds of the destination heap allocation. This permits a write past the end of the buffer.

Attack Vector

The attack requires Bluetooth proximity to a target device with Bluetooth enabled. An attacker sends a crafted GATT primary service request to the victim's Bluetooth stack. No pairing, authentication, or user prompt is required to reach the vulnerable code path. Successful exploitation yields remote code execution in the context of the Bluetooth process.

No verified public proof-of-concept code is available. Technical specifics are described in the Android Security Bulletin January 2025.

Detection Methods for CVE-2024-49748

Indicators of Compromise

Unexpected crashes or restarts of the bluetooth system process on Android devices
Anomalous Bluetooth GATT traffic from unknown peripherals attempting service discovery before pairing
Tombstone files in /data/tombstones/ referencing gatt_sr.cc or gatts_process_primary_service_req

Detection Strategies

Monitor Android logcat output and bug reports for repeated Bluetooth stack crashes correlated with nearby unknown devices
Use Bluetooth traffic capture (HCI snoop logs) to identify malformed GATT primary service request PDUs
Inventory devices in your fleet and flag any running Android 12 through 15 without the January 2025 security patch level

Monitoring Recommendations

Enforce a minimum Android security patch level of 2025-01-01 or later through mobile device management (MDM) compliance policies
Alert on devices reporting Bluetooth subsystem crashes in enterprise mobility analytics
Track Android Security Bulletin advisories monthly and reconcile against deployed device patch levels

How to Mitigate CVE-2024-49748

Immediate Actions Required

Apply the Android security patch level 2025-01-01 or later to all affected devices
Identify devices running Android 12 through 15 that have not received the January 2025 update and prioritize them for remediation
Restrict Bluetooth usage on unpatched devices, particularly in public or high-risk environments

Patch Information

Google published the fix in the Android Security Bulletin January 2025. Device manufacturers integrate the AOSP patch into their own over-the-air updates. Confirm the security patch level on each device under Settings > About phone > Android security update.

Workarounds

Disable Bluetooth on devices that cannot be patched immediately
Limit device use to trusted environments where untrusted Bluetooth peers are unlikely to be in range
Enforce MDM policies that disable Bluetooth discovery for non-compliant devices

bash

# Check the current Android security patch level via adb
adb shell getprop ro.build.version.security_patch
# Expected output for remediated devices: 2025-01-01 or later