CVE-2024-47025: Pixel-family Specific PPCFW Read Privilege Not Revoked for Non-GPU Owned Protected Memory
Summary
CVE-2024-47025: In ppmp_protect_buf of drm_fw.c, there is a possible information disclosure due to a logic error in the code. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2024-10-05. Fixed in Pixel-family specific:2024-10-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vulnerability affects the Pixel-family devices running Android, specifically within the DRM framework. This framework is responsible for managing digital rights and protected content, ensuring that only authorized users can access certain media. The issue arises from a logic error in the code that handles memory protection, potentially exposing sensitive information.
Vulnerability Detail
In the function ppmp_protect_buf of drm_fw.c, a logic error allows for the read privilege of protected memory to remain active for non-GPU owned resources. This oversight can lead to local information disclosure, where unauthorized users may access sensitive data without needing additional execution privileges. The vulnerability does not require user interaction, making it particularly concerning for device security.
How To Fix
Minimum fixed version
Pixel-family specific:2024-10-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available to mitigate this vulnerability until the patch is applied. Users are advised to regularly check for updates and apply them as soon as they are available.
Conclusion
CVE-2024-47025 represents a serious vulnerability in the Pixel-family devices that could lead to unauthorized access to sensitive information. Users are strongly encouraged to update their devices to the latest firmware to mitigate this risk. Regular monitoring and prompt updates are essential for maintaining device security.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2024-47025 is a vulnerability in the Pixel-family devices that allows unauthorized access to protected memory due to a logic error in the DRM framework.
This vulnerability can lead to local information disclosure, potentially exposing sensitive information stored in protected memory.
No, user interaction is not required for exploitation, making it a significant security concern.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update your device, it is recommended to limit access to sensitive information and monitor for any unusual activity until a fix can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
