CVE-2024-49739: Android Package Vulnerability Leading to Local Privilege Escalation
Summary
CVE-2024-49739: In MMapVAccess of pmr_os.c, there is a possible out of bounds write due to improper input validation. Affects :unknown: versions >= SoCVersion:0, < SoCVersion:2025-05-05. Fixed in SoCVersion:2025-05-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The affected package is part of the Android ecosystem, which is widely used for mobile devices. Android provides a rich application framework that allows developers to build innovative apps and games for mobile users. However, vulnerabilities can arise due to improper input validation, which can compromise the security of the system. This specific vulnerability is found in the MMapVAccess function within the pmr_os.c file, highlighting the importance of secure coding practices in Android development.
Vulnerability Detail
In MMapVAccess of pmr_os.c, there is a possible out of bounds write due to improper input validation. This vulnerability can lead to local escalation of privilege, allowing an attacker to gain higher access rights without needing additional execution privileges. The exploitation does not require user interaction, making it particularly dangerous as it can be executed silently by malicious software.
How To Fix
Minimum fixed version
SoCVersion:2025-05-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is highly recommended to apply the patch as soon as it becomes available to ensure system security.
Conclusion
The CVE-2024-49739 vulnerability presents a serious risk to Android devices due to improper input validation leading to local privilege escalation. It is crucial for users and developers to stay informed about such vulnerabilities and apply necessary updates promptly to maintain system integrity.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2024-49739 is a vulnerability in the Android ecosystem that allows for local privilege escalation due to an out of bounds write in the MMapVAccess function.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor vulnerabilities without needing to sign up.
The main risk is local privilege escalation, which could allow an attacker to gain unauthorized access to sensitive system resources.
No, user interaction is not needed for exploitation, making it a significant security concern.
Ensure that your device is updated to the latest version (SoCVersion 2025-05-05 or later) to mitigate the risks associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
