A logic error in the process_service_attr_rsp function of sdp_discovery.cc can lead to a possible use after free vulnerability. This issue allows for remote code execution without requiring additional execution privileges or user interaction. The vulnerability poses significant risks due to its high impact on confidentiality, integrity, and availability.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2025-22411 |
Exploitation
To exploit this vulnerability, an attacker within the adjacent network can send specially crafted packets to the affected device, triggering the use after free condition. This allows the attacker to execute arbitrary code on the device without needing any user interaction or elevated privileges.
Affected Products
- Bluetooth Module: Vulnerable to remote code execution due to the logic error in the service attribute response handling.
- Android Devices: All devices utilizing the affected Bluetooth module are at risk of exploitation.
Mitigation
To mitigate this vulnerability, users should ensure their devices are updated with the latest security patches provided by Android. Additionally, disabling Bluetooth when not in use can help reduce the risk of exploitation.