CVE-2024-23697: Android Kernel Arbitrary Code Execution via Use After Free in RGXCreateHWRTData_aux
Summary
CVE-2024-23697: In RGXCreateHWRTData_aux of rgxta3d.c, there is a possible arbitrary code execution due to a use after free. Affects :unknown: versions >= SoCVersion:0, < SoCVersion:2024-06-05. Fixed in SoCVersion:2024-06-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The affected package is part of the Android operating system, which is a widely used open-source platform for mobile devices. Android provides a rich application framework that allows developers to build innovative apps and games. The RGXCreateHWRTData_aux function in rgxta3d.c is responsible for handling certain graphics operations. This vulnerability arises from improper memory management, specifically a use after free condition, which can lead to severe security risks.
Vulnerability Detail
In RGXCreateHWRTData_aux of rgxta3d.c, there is a possible arbitrary code execution due to a use after free. This vulnerability allows an attacker to execute arbitrary code in the kernel, leading to local escalation of privilege without requiring additional execution privileges. The exploitation of this vulnerability does not require user interaction, making it particularly dangerous.
How To Fix
Minimum fixed version
SoCVersion:2024-06-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2024-23697 represents a serious vulnerability in the Android kernel that can lead to arbitrary code execution. Users are strongly advised to update their devices to the patched version to protect against potential exploitation. Regular monitoring and updates are essential for maintaining device security.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2024-23697 is a vulnerability in the Android kernel that allows for arbitrary code execution due to a use after free condition in the RGXCreateHWRTData_aux function.
This vulnerability can lead to local escalation of privilege, allowing an attacker to execute arbitrary code in the kernel, which can compromise the security of your device.
No, user interaction is not needed for exploitation, making it a significant security risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
While there are no specific workarounds, it is crucial to apply the patch as soon as possible to mitigate the risk associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
