CVE-2025-0075: Google Android RCE Vulnerability

CVE-2025-0075 Overview

A critical use after free vulnerability has been identified in the Android Bluetooth stack, specifically within the process_service_search_attr_req function of sdp_server.cc. This memory corruption flaw enables remote code execution without requiring any user interaction or additional execution privileges, making it particularly dangerous for mobile device security.

Critical Impact

Remote attackers can exploit this use after free condition in the Bluetooth SDP server to execute arbitrary code on affected Android devices without user interaction.

Affected Products

• Google Android 15.0

Discovery Timeline

• 2025-08-26 - CVE-2025-0075 published to NVD
• 2025-09-02 - Last updated in NVD database

Technical Details for CVE-2025-0075

Vulnerability Analysis

This vulnerability is classified as CWE-416 (Use After Free), a memory corruption class that occurs when a program continues to use a pointer after the memory it references has been deallocated. In the context of the Android Bluetooth SDP (Service Discovery Protocol) server, the vulnerable function process_service_search_attr_req improperly handles memory during service search attribute request processing.

The SDP server component is responsible for handling Bluetooth service discovery queries from remote devices. When processing incoming attribute requests, the code fails to properly manage memory object lifecycles, allowing an attacker to trigger a condition where freed memory is subsequently accessed. This dangling pointer condition can be exploited to achieve arbitrary code execution.

Root Cause

The root cause lies in improper memory lifecycle management within the sdp_server.cc implementation. The process_service_search_attr_req function deallocates memory objects while retaining references to them, creating a use after free condition. When the code later attempts to access the freed memory, an attacker who has manipulated the heap can redirect execution flow to attacker-controlled code.

Attack Vector

The vulnerability is exploitable over the network via Bluetooth communication. An attacker within Bluetooth range can send specially crafted SDP service search attribute requests to trigger the use after free condition. Key characteristics of this attack vector include:

• Network-based exploitation: Attackable via Bluetooth protocol communication
• No authentication required: Exploitation does not require prior device pairing or authentication
• Zero user interaction: The attack can be executed without any victim action
• Silent exploitation: Users may have no indication of compromise

The attack targets the SDP server's request handling logic. By crafting malicious SDP packets that manipulate the timing and content of service discovery requests, an attacker can cause memory to be freed prematurely while maintaining references that will be used in subsequent operations.

Detection Methods for CVE-2025-0075

Indicators of Compromise

• Unexpected Bluetooth service crashes or restarts on Android devices
• Anomalous SDP traffic patterns or malformed service discovery requests in Bluetooth logs
• Memory access violations or segmentation faults in Bluetooth-related processes
• Unusual process behavior following Bluetooth connections from unknown devices

Detection Strategies

• Monitor for Bluetooth stack crashes and restarts that may indicate exploitation attempts
• Implement network-level detection for anomalous SDP packet structures targeting Android devices
• Deploy endpoint detection solutions capable of identifying memory corruption exploitation patterns
• Analyze system logs for evidence of Bluetooth service abnormalities or unexpected code execution

Monitoring Recommendations

• Enable verbose Bluetooth logging on high-value Android devices to capture exploitation attempts
• Implement behavioral monitoring for the Bluetooth process (com.android.bluetooth) on managed devices
• Establish baselines for normal SDP traffic patterns to identify deviations
• Configure alerting for Bluetooth service crashes or unexpected restarts across managed device fleets

How to Mitigate CVE-2025-0075

Immediate Actions Required

• Apply the Android security patch dated March 2025 or later immediately to all affected devices
• Consider temporarily disabling Bluetooth on high-value devices until patches can be applied
• Limit Bluetooth discoverability to reduce the attack surface
• Ensure enterprise MDM solutions enforce security patch compliance

Patch Information

Google has addressed this vulnerability in the Android Security Bulletin March 2025. The fix is available in the Android Bluetooth Module Update (commit 5959f8bcf4efe924b0ba4dbcbfe83e602f0eb0ac). Organizations should ensure all Android 15.0 devices receive the March 2025 security update or later.

Workarounds

• Disable Bluetooth when not actively in use to eliminate the attack vector
• Configure devices to be non-discoverable by default to reduce exposure
• Use device management policies to enforce Bluetooth restrictions in high-security environments
• Implement network segmentation to limit the potential impact of compromised mobile devices

# Android ADB commands to check security patch level
adb shell getprop ro.build.version.security_patch
# Expected output should be 2025-03-01 or later

# Disable Bluetooth via ADB (requires root or appropriate permissions)
adb shell settings put global bluetooth_on 0