A vulnerability in the process_service_attr_rsp function of sdp_discovery.cc allows for the execution of arbitrary code due to a use after free condition. This could lead to remote code execution without requiring additional execution privileges. User interaction is not necessary for exploitation, making it a critical security concern.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.8 | CVE-2025-0074 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted network packets to the affected service, which can trigger the use after free condition. This allows the attacker to execute arbitrary code on the target device without any user interaction.
Affected Products
- Bluetooth Module: Vulnerable to remote code execution due to improper handling of service attributes.
- Android Devices: All devices running the affected version of the Bluetooth module are at risk.
Mitigation
To mitigate this vulnerability, users should ensure that their devices are updated to the latest security patches provided by Android. Additionally, disabling Bluetooth when not in use can help reduce the risk of exploitation.