Android Bluetooth Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in the Bluetooth GATT server implementation of Android. This issue arises from an out-of-bounds write in the 'gatts_process_find_info' function, gatt_sr.cc, due to a missing bounds check. The vulnerability allows for code execution on the affected device, requiring no additional privileges and no user interaction. It affects several Android versions, including 12, 12L, 13, 14, and 15.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected device.

Remediation

Users can update their devices to the January 2025 security patch level to address this vulnerability.