CVE-2025-22411: Google Android Use-After-Free Vulnerability

CVE-2025-22411 Overview

CVE-2025-22411 is a use-after-free vulnerability in the Android Bluetooth stack, specifically within the process_service_attr_rsp function of sdp_discovery.cc. A logic error in the Service Discovery Protocol (SDP) response handling allows an attacker within Bluetooth range to trigger memory corruption that can lead to remote code execution. Exploitation requires no user interaction and no additional execution privileges. The flaw is tracked under CWE-416 and was addressed in the Android Security Bulletin March 2025.

Critical Impact
An adjacent attacker can execute arbitrary code on a vulnerable Android device over Bluetooth without user interaction.

Affected Products

Google Android 15.0
Devices running Android Bluetooth stack prior to the March 2025 security patch level
Android Open Source Project (AOSP) Bluetooth module builds before commit 806774b1cf641e0c0e7df8024e327febf23d7d7c

Discovery Timeline

2025-08-26 - CVE-2025-22411 published to NVD
2025-09-02 - Last updated in NVD database

Technical Details for CVE-2025-22411

Vulnerability Analysis

The vulnerability resides in process_service_attr_rsp within sdp_discovery.cc, a component of the Android Bluetooth stack that processes responses to SDP Service Attribute requests. SDP allows Bluetooth devices to advertise and query the services they support. When the function processes a crafted attribute response, a logic error causes it to reference memory that has already been freed.

The attacker reaches the vulnerable code path by initiating or responding to an SDP transaction over an adjacent Bluetooth link. Because the bug occurs during normal protocol processing, no pairing prompts, taps, or other user actions are required. Successful exploitation grants code execution within the privileges of the Bluetooth process.

Root Cause

The root cause is a logic flaw governing object lifetime during SDP attribute response parsing. A pointer in the discovery state continues to be used after the underlying memory has been released, producing a classic CWE-416 condition. The upstream fix corrects the ordering of state cleanup and reference handling in the SDP discovery routine.

Attack Vector

Exploitation requires only adjacent network access, meaning the attacker must be within Bluetooth radio range of the target device. The attacker sends crafted SDP responses that trigger the use-after-free in process_service_attr_rsp. Refer to the Android Bluetooth Code Update for the specific code changes that resolve the condition.

No public proof-of-concept exploit code is available for CVE-2025-22411 at the time of writing.

Detection Methods for CVE-2025-22411

Indicators of Compromise

Unexpected crashes or restarts of the com.android.bluetooth process recorded in logcat or tombstoned dumps
SIGSEGV or SIGABRT signals originating from libbluetooth with stack frames referencing sdp_discovery or process_service_attr_rsp
Repeated inbound SDP service attribute requests from unknown Bluetooth peers preceding a Bluetooth stack crash

Detection Strategies

Collect and review Android tombstone files and dropbox crash entries for native crashes in the Bluetooth process referencing SDP functions.
Monitor mobile fleet telemetry for devices below the 2025-03-01 Android security patch level that still have Bluetooth enabled.
Correlate Bluetooth scan and connection events with subsequent Bluetooth service crashes to identify probing activity from nearby attackers.

Monitoring Recommendations

Use Mobile Device Management (MDM) compliance policies to flag devices missing the March 2025 Android security patch level.
Forward Android system and crash logs from managed devices into a centralized data lake or SIEM for correlation across the mobile fleet.
Track Bluetooth pairing and discovery anomalies in physical environments where high-value users operate, such as executive offices and conference areas.

How to Mitigate CVE-2025-22411

Immediate Actions Required

Install the Android security patch level 2025-03-01 or later on all affected devices through OEM updates.
Where patches are not yet available from the device manufacturer, disable Bluetooth on the device or set it to non-discoverable until updates are applied.
Inventory Android 15 devices in the environment and prioritize patching for devices used in public or untrusted Bluetooth environments.

Patch Information

Google released the fix in the Android Security Bulletin March 2025. The AOSP code change is published in the Android Bluetooth Code Update. Device patch availability depends on the OEM and carrier release schedule, so enterprise administrators should confirm patch level rather than rely on Android version alone.

Workarounds

Disable Bluetooth on unpatched devices, especially in public or high-risk locations such as airports, conferences, and public transit.
Restrict Bluetooth usage on managed devices through MDM policy until vendor patches are deployed.
Educate users to avoid accepting Bluetooth connections from unknown devices and to keep Bluetooth disabled when not in active use.

bash

# Verify Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output: 2025-03-01 or later

# Disable Bluetooth as a temporary workaround on unpatched devices
adb shell svc bluetooth disable