Android Bluetooth Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in the Android Bluetooth module, specifically within the 'build_read_multi_rsp' function of 'gatt_sr.cc'. This issue arises from a missing bounds check, which creates a potential for out-of-bounds write. Exploitation of this vulnerability does not require any additional execution privileges and can be carried out remotely, provided the attacker is in close proximity to the affected device.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected device.

Remediation

Users can update their devices to the January 2025 security patch level to address this vulnerability.