CVE-2024-53837: Android Pixel-family Specific Package Out of Bounds Write Vulnerability
Summary
CVE-2024-53837: In prepare_response of lwis_periodic_io.c, there is a possible out of bounds write due to an integer overflow. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2024-12-05. Fixed in Pixel-family specific:2024-12-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The affected package is part of the Android ecosystem, specifically targeting Pixel-family devices. This package is responsible for handling periodic I/O operations, which are crucial for maintaining the performance and responsiveness of applications. The vulnerability arises from an integer overflow in the 'prepare_response' function, potentially allowing unauthorized privilege escalation.
Vulnerability Detail
In the 'prepare_response' function of 'lwis_periodic_io.c', an integer overflow can lead to an out of bounds write. This vulnerability allows a local attacker to escalate privileges without requiring additional execution rights. The flaw is particularly concerning as it can be exploited without user interaction, making it a significant security risk for affected devices.
How To Fix
Minimum fixed version
Pixel-family specific:2024-12-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available to mitigate this vulnerability other than applying the patch. Users are advised to keep their devices updated to the latest version.
Conclusion
CVE-2024-53837 presents a significant security risk for users of Pixel-family Android devices due to an out of bounds write vulnerability caused by an integer overflow. Users are strongly advised to update their devices to the latest patched version to mitigate this risk.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2024-53837 is a vulnerability in the Android Pixel-family specific package that allows for an out of bounds write due to an integer overflow, leading to potential local privilege escalation.
If you own a Pixel-family device running an affected version of the Android operating system, it may be vulnerable. You can check for updates or use tools like Vulert to monitor for vulnerabilities.
No, user interaction is not needed for exploitation, which increases the risk of this vulnerability.
If you are unable to update your device, consider using Vulert to monitor for vulnerabilities and assess your application's exposure to this issue.
Vulert is a monitoring tool that uses the gradle.lockfile to alert users in real-time about open-source vulnerabilities in their software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
