CVE-2024-47014: Android Pixel-family Specific OOB Write Vulnerability
Summary
CVE-2024-47014: ... Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2024-10-05. Fixed in Pixel-family specific:2024-10-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The affected package is part of the Android ecosystem, specifically targeting Pixel-family devices. Android is a widely used mobile operating system that supports a variety of applications and services. The Pixel-family devices are known for their integration of hardware and software, providing users with a seamless experience. However, this specific vulnerability arises from incorrect size validation in the device information, which can lead to serious security issues.
Vulnerability Detail
The vulnerability identified as CVE-2024-47014 is caused by incorrect validation of the size of device information (devinfo). This flaw allows an out-of-bounds (OOB) write, potentially leading to unauthorized access or escalation of privileges. Attackers could exploit this vulnerability to manipulate memory, which may result in system crashes or unauthorized control over the device. The issue is particularly concerning as it affects the security of the device and the privacy of the user.
How To Fix
Minimum fixed version
Pixel-family specific:2024-10-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available to mitigate this vulnerability until the patch is applied. Users are advised to keep their devices updated and monitor for any security advisories from their device manufacturer.
Conclusion
CVE-2024-47014 represents a significant security concern for Android Pixel-family devices due to an out-of-bounds write vulnerability stemming from improper validation of device information size. Users are strongly encouraged to apply the available patch to safeguard their devices against potential exploitation.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2024-47014 is a vulnerability affecting Android Pixel-family devices due to incorrect validation of device information size, leading to potential out-of-bounds writes.
If you own a Pixel-family device running an affected version of Android, you are at risk. You can check for updates or use tools like Vulert to monitor vulnerabilities.
The risks include unauthorized access, privilege escalation, and potential manipulation of device memory, which can compromise user data and device functionality.
Yes, a patch was released on October 5, 2024. Users should update their devices to this version to mitigate the vulnerability.
Yes, Vulert can monitor your project for open-source vulnerabilities in real-time using just the gradle.lockfile. You can check if your application is affected by visiting the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
