PT-2025-1032 · Google · Android

Published 2025-01-01 · Updated 2025-01-22 · CVE-2024-43771

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android (affected versions not specified)

Description The issue is related to incorrect code generation management in the Android operating system's System component. It could allow a remote attacker to execute arbitrary code due to a missing bounds check in gatts process read req of gatt sr.cc, leading to a possible out of bounds write. This could result in remote code execution with no additional execution privileges needed, and user interaction is not required for exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Memory Corruption

Code Injection

Weakness Enumeration

CWE-787

CWE-94

Related Identifiers

ASB-A-364027949

BDU:2025-00237

CVE-2024-43771

Affected Products

Android

References · 11

• https://osv.dev/vulnerability/ASB-A-364027949 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00237 · Security Note
• https://source.android.com/security/bulletin/2025-01-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43771 · Security Note
• https://osv.dev/vulnerability/CVE-2024-43771 · Vendor Advisory
• https://source.android.com/docs/security/bulletin/2025-01-01?hl=ru · Note
• https://securityonline.info/cve-2024-43096-and-more-critical-rce-flaws-patched-in-android-security-update · Note
• https://twitter.com/VulmonFeeds/status/1881990047865462898 · Twitter Post
• https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c7468e64bb5e821563a910ccd8e5693c179c9da4 · Note
• https://twitter.com/xvonfers/status/1877676649241588034 · Twitter Post
• https://twitter.com/CVEnew/status/1881933300203233379 · Twitter Post