CVE-2024-43770
Published: 21 January 2025
Summary
CVE-2024-43770 is a high-severity Code Injection (CWE-94) vulnerability in Google Android. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked at the 13.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2024-43770 is a vulnerability involving an out-of-bounds write due to a missing bounds check in the gatts_process_find_info function of gatt_sr.cc. This issue affects the Android Bluetooth GATT server component.
The vulnerability enables remote proximal or adjacent code execution with no additional execution privileges required and no user interaction needed. Per the CVSS v3.1 score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), an unauthenticated attacker within Bluetooth range can exploit it with low complexity to gain high-impact control over confidentiality, integrity, and availability.
The Android Security Bulletin for January 2025 at https://source.android.com/security/bulletin/2025-01-01 details patches addressing this CVE in supported Android versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-40294
Vulnerability details
In gatts_process_find_info of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OOB write in Android Bluetooth GATT server enables unauthenticated adjacent RCE, directly mapping to exploitation of an exposed remote service over Bluetooth.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces bounds checking and validation on information inputs to the gatts_process_find_info function, directly preventing the out-of-bounds write in Bluetooth GATT server processing.
Provides memory protection mechanisms such as bounds checking and stack guards that mitigate out-of-bounds writes even if input validation fails in the GATT server.
Requires timely remediation of identified flaws like the missing bounds check in gatt_sr.cc, as addressed by the Android Security Bulletin patches.