CVE-2024-0031
📋 TL;DR
This CVE describes a critical Bluetooth protocol vulnerability in Android's ATT (Attribute Protocol) implementation. An out-of-bounds write due to improper input validation in attp_build_read_by_type_value_cmd could allow remote code execution without user interaction. Android devices with vulnerable Bluetooth implementations are affected.
💻 Affected Systems
- Android devices with Bluetooth functionality
📦 What is this software?
Android by Google
Android by Google
Android by Google
Android by Google
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker gains full control of device via Bluetooth without user interaction, potentially leading to data theft, surveillance, or device compromise.
Likely Case
Remote code execution allowing attacker to install malware, exfiltrate data, or disrupt device functionality via Bluetooth proximity.
If Mitigated
Attack prevented if Bluetooth is disabled or device is patched; limited to Bluetooth range (~10 meters).
🎯 Exploit Status
Exploitation requires Bluetooth proximity but no authentication; technical details suggest specialized Bluetooth protocol knowledge needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android Security Bulletin February 2024 patches
Vendor Advisory: https://source.android.com/security/bulletin/2024-02-01
Restart Required: Yes
Instructions:
1. Apply February 2024 Android security updates via Settings > System > System update. 2. For enterprise devices, deploy updates through MDM. 3. Verify patch installation via Settings > About phone > Android security patch level.
🔧 Temporary Workarounds
Disable Bluetooth
androidTurn off Bluetooth when not in use to prevent exploitation
adb shell settings put global bluetooth_on 0
Settings > Connected devices > Connection preferences > Bluetooth > Toggle off
Restrict Bluetooth visibility
androidSet Bluetooth to non-discoverable mode to reduce attack surface
adb shell settings put global bluetooth_discoverability 0
Settings > Connected devices > Connection preferences > Bluetooth > Device name > Turn off 'Make device discoverable'
🧯 If You Can't Patch
- Disable Bluetooth completely on vulnerable devices
- Implement network segmentation to isolate Bluetooth-enabled devices from critical networks
🔍 How to Verify
Check if Vulnerable:
Check if device has February 2024 security patch: Settings > About phone > Android security patch level. If date is before February 2024, device is likely vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify Android security patch level shows 'February 5, 2024' or later in Settings > About phone📡 Detection & Monitoring
Log Indicators:
- Unusual Bluetooth connection attempts in Bluetooth system logs
- Crash logs from Bluetooth service (bluetoothd)
Network Indicators:
- Anomalous Bluetooth traffic patterns
- Unexpected Bluetooth pairing requests
SIEM Query:
source="android_logs" AND process="bluetooth" AND (event="crash" OR event="error")🔗 References
- https://android.googlesource.com/platform/packages/modules/Bluetooth/+/de53890aaca2ae08b3ee2d6e3fd25f702fdfa661
- https://source.android.com/security/bulletin/2024-02-01
- https://android.googlesource.com/platform/packages/modules/Bluetooth/+/de53890aaca2ae08b3ee2d6e3fd25f702fdfa661
- https://source.android.com/security/bulletin/2024-02-01
