HEXACON Researchers Detail Android Bluetooth Exploit for a Heap Overflow Fixed in 2023

Summary

HEXACON speakers described exploiting an Android Bluetooth heap overflow fixed in 2023 to obtain shells without user interaction. Tests on Xiaomi and Samsung devices showed low reliability, with repeated attempts taking roughly two to five minutes.

Key points

The researchers described a GATT server integer overflow that turns a crafted multi-attribute request into an approximately 64 KB out-of-bounds memory copy.
They used the Bluetooth Just Works authentication method to reach services without user notification or interaction, while noting that some services require stronger authentication.
ACL congestion and L2CAP configuration rejection messages enabled persistent heap spraying; ERTM fragments provided memory disclosure and write primitives.
The exploitation chain leaked callback contents and redirected function pointers to execute code. Scudo required separate overflows for memory disclosure and callback corruption.
The researchers tested exploits on Xiaomi devices using jemalloc and Samsung devices using Scudo, reporting approximately two and up to five minutes respectively to obtain a shell through repeated attempts.
Their post-exploitation payload supported shell commands and file transfer over Bluetooth. Failed attempts could crash the Bluetooth process, which silently restarted.
The speakers said the vulnerability was fixed in 2023 and that the partial Rust rewrite available at that time did not remove the affected C implementation.

Article Details

Topics: [01:32] Bluetooth stack architecture and service access controls
[03:20] Custom Bluetooth research framework using Scapy
[04:19] Just Works authentication and its security limitations
[08:17] GATT server integer overflow and oversized memory copy
[14:04] Heap spraying, ACL congestion, and ERTM exploitation primitives
[27:39] Heap shaping and callback-based code execution
[34:27] Adapting exploitation to Scudo hardening
[39:37] Bluetooth shell payload, test reliability, and Rust rewrite limitations