CVE-2021-0522
📋 TL;DR
This vulnerability in Android's Bluetooth stack allows remote attackers to read memory they shouldn't access via a use-after-free bug in SDP callback handling. It affects Android devices running versions 9, 10, and 11, potentially exposing sensitive information without user interaction.
💻 Affected Systems
- Android
📦 What is this software?
Android by Google
Android by Google
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker gains unauthorized access to sensitive device memory, potentially extracting authentication tokens, encryption keys, or other protected data.
Likely Case
Information disclosure of Bluetooth-related data or adjacent memory contents, potentially enabling further attacks.
If Mitigated
No impact if patched; limited impact if Bluetooth is disabled or device is not discoverable.
🎯 Exploit Status
Exploitation requires Bluetooth proximity and knowledge of the vulnerability; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android Security Patch Level 2021-06-01 or later
Vendor Advisory: https://source.android.com/security/bulletin/2021-06-01
Restart Required: Yes
Instructions:
1. Check for system updates in Settings > System > Advanced > System update. 2. Install Android Security Patch Level 2021-06-01 or later. 3. Reboot device after installation.
🔧 Temporary Workarounds
Disable Bluetooth
androidTurn off Bluetooth to prevent exploitation via this vector
adb shell settings put global bluetooth_on 0
Settings > Connected devices > Connection preferences > Bluetooth > Toggle off
Disable Bluetooth Discovery
androidMake device non-discoverable to reduce attack surface
adb shell settings put global bluetooth_discoverability 0
Settings > Connected devices > Connection preferences > Bluetooth > Device name > Turn off 'Make device discoverable'
🧯 If You Can't Patch
- Disable Bluetooth when not in use, especially in high-risk environments
- Implement physical security controls to limit Bluetooth proximity to untrusted devices
🔍 How to Verify
Check if Vulnerable:
Check Android Security Patch Level: Settings > About phone > Android version > Android security updateCheck Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify Android Security Patch Level is 2021-06-01 or later📡 Detection & Monitoring
Log Indicators:
- Bluetooth SDP connection failures
- Bluetooth stack crashes in logcat
Network Indicators:
- Unusual Bluetooth SDP requests from unknown devices
SIEM Query:
Not typically applicable for Bluetooth-based attacks on mobile devices