CVE-2024-0030

MEDIUM

Google Android - Out-of-Bounds Read

Title source: rule

Description

In btif_to_bta_response of btif_gatt_util.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Exploits (1)

nomisec WRITEUP

by uthrasri · poc

https://github.com/uthrasri/system_bt_CVE-2024-0030

View Code ZIP pw:eip

References (2)

[Mailing List, Patch] https://android.googlesource.com/platform/packages/modules/Bluetooth/+/57b823f4f758e2ef530909da07552b5aa80c6a7d

[Patch, Vendor Advisory] https://source.android.com/security/bulletin/2024-02-01

Scores

CVSS v3 5.5

EPSS 0.0151

EPSS Percentile 81.3%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-125

Status published

Products (5)

google/android 11.0

google/android 12.0

google/android 12.1

google/android 13.0

google/android 14.0

Published Feb 16, 2024

Tracked Since Feb 18, 2026