Android Bluetooth Stack Out-of-Bounds Write Vulnerability Allowing Remote Code Execution

A vulnerability has been identified in the Android Bluetooth stack, specifically in the 'gatts_process_read_req' function of 'gatt_sr.cc'. This issue arises from a missing bounds check, which creates a potential for out-of-bounds write operations. Exploitation of this vulnerability could lead to remote code execution, with no additional privileges required. Notably, user interaction is not necessary for exploitation.

Impact

Exploitation of this vulnerability could result in remote code execution on the affected device.

Remediation

Users can update their devices to the January 2025 security patch level to address this vulnerability. Instructions for checking and updating the Android version are available on the Google Support website.