Possible Out of Bounds Write in attp_build_value_cmd Could Lead to Remote Code Execution
CVE-2024-0039
Key Information:
Badges
Summary
The Android Bluetooth module contains a flaw in the attp_build_value_cmd function within att_protocol.cc, which leads to a potential out of bounds write due to a lack of bounds checking. If exploited, this vulnerability could enable an attacker to execute arbitrary code remotely without the need for user interaction, posing significant security risks to affected systems. Administrators and developers should prioritize evaluating their implementations of the Bluetooth module and apply any available security patches to mitigate the threat.
Affected Version(s)
Android 14
Android 13
Android 12L
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
News Articles
securityonline.infoCVE-2024-0039CVE-2024-0039: Critical Android Remote Code Execution Vulnerability
CVE-2024-0039 is a critical security flaw in the System component that could lead to RCE with no additional execution privileges needed
10 months ago
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
- 📰
First article discovered by securityonline.info
Vulnerability Reserved