In process_service_search_attr_req of sdp_server.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.8 | CVE-2025-0075 |
Exploitation
The vulnerability can be exploited remotely without user interaction, allowing an attacker to execute arbitrary code on the affected system. This can be achieved by sending specially crafted network requests that trigger the use after free condition in the sdp_server.cc component.
Affected Products
- Bluetooth Module: Vulnerable to remote code execution due to improper handling of service search attributes.
- Android Devices: All devices utilizing the affected Bluetooth module are at risk.
Mitigation
To mitigate this vulnerability, users should ensure their devices are updated with the latest security patches provided by the vendor. Disabling Bluetooth when not in use can also reduce the risk of exploitation.