CVE-2024-43096: High severity Google Android vulnerability
In buildreadmultirsp of gattsr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/packages/modules/Bluetoothto a version that resolves this vulnerability.Fixed in 15-next:2025-01-01 - Upgrade
Upgrade
android/platform/system/btto a version that resolves this vulnerability.Fixed in 12:2025-01-01 - Upgrade
Upgrade
android/platform/system/btto a version that resolves this vulnerability.Fixed in 12L:2025-01-01 - Upgrade
Upgrade
android/platform/packages/modules/Bluetoothto a version that resolves this vulnerability.Fixed in 15:2025-01-01 - Upgrade
Upgrade
android/platform/packages/modules/Bluetoothto a version that resolves this vulnerability.Fixed in 13:2025-01-01 - Upgrade
Upgrade
android/platform/packages/modules/Bluetoothto a version that resolves this vulnerability.Fixed in 14:2025-01-01
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43096?
CVE-2024-43096 has a high severity rating due to the potential for remote code execution.
How do I fix CVE-2024-43096?
Fixing CVE-2024-43096 involves updating affected versions of Google Android as per the security guidelines provided.
Who is affected by CVE-2024-43096?
CVE-2024-43096 affects devices running Google Android, particularly those utilizing the GATT services.
What kind of exploitation is possible with CVE-2024-43096?
CVE-2024-43096 could allow an attacker to execute arbitrary code remotely without requiring additional privileges.
Is user interaction needed to exploit CVE-2024-43096?
No, user interaction is not needed for the exploitation of CVE-2024-43096.