CVE-2024-47034: Out of Bounds Access in Darwin NPU Firmware for Android
Summary
CVE-2024-47034: there is a possible out of bounds read due to a missing bounds check. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2024-10-05. Fixed in Pixel-family specific:2024-10-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Darwin NPU firmware is a critical component in Android devices, particularly those in the Pixel family. It is responsible for processing various tasks related to neural processing and machine learning. This firmware is designed to enhance the performance of applications that rely on AI and machine learning capabilities. However, like any software, it is susceptible to vulnerabilities that can compromise its functionality and security.
Vulnerability Detail
The vulnerability identified as CVE-2024-47034 is an out-of-bounds (OOB) access issue stemming from a missing bounds check in the Darwin NPU firmware. This flaw allows for a potential out-of-bounds read, which could lead to local information disclosure. Importantly, this vulnerability does not require any additional execution privileges or user interaction for exploitation, making it a significant security concern for affected devices.
How To Fix
Minimum fixed version
Pixel-family specific:2024-10-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to apply the firmware update as soon as it becomes available.
Conclusion
CVE-2024-47034 represents a significant security vulnerability in the Darwin NPU firmware for Android devices, particularly the Pixel family. Users are strongly encouraged to update their firmware to the latest version to protect against potential information disclosure risks.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2024-47034 is a vulnerability in the Darwin NPU firmware that allows for out-of-bounds access, potentially leading to local information disclosure.
If you own a Pixel-family device, it is advisable to check for firmware updates regularly, as this vulnerability specifically affects those devices.
Yes, you should update your device to the patched version of the firmware as soon as it is available to mitigate the risk associated with this vulnerability.
No, user interaction is not needed for exploitation, which makes this vulnerability particularly concerning.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. Check out their playground at Vulert Scanner to see if your application is affected.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
