CVE-2024-56185: Android Pixel-family ProtocolCallAdapter Out-of-Bounds Read Vulnerability
Summary
CVE-2024-56185: In ProtocolUnsolOnSSAdapter::GetServiceClass() of protocolcalladapter.cpp, there is a possible out-of-bounds read due to a missing bounds check. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2025-03-05. Fixed in Pixel-family specific:2025-03-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ProtocolCallAdapter is a component within the Android ecosystem, specifically designed for handling protocol calls in Pixel-family devices. It plays a crucial role in managing communication between various system components and services. However, it has been identified to have a vulnerability that could lead to potential information disclosure if exploited.
Vulnerability Detail
In ProtocolUnsolOnSSAdapter::GetServiceClass() of protocolcalladapter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This vulnerability could allow an attacker to read sensitive information from memory, leading to local information disclosure. Exploitation requires a compromise of the baseband firmware, and user interaction is not necessary for the attack to succeed.
How To Fix
Minimum fixed version
Pixel-family specific:2025-03-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available to mitigate this vulnerability without applying the patch. Users are advised to keep their devices updated to the latest software version.
Conclusion
CVE-2024-56185 represents a significant vulnerability in the ProtocolCallAdapter of Android Pixel-family devices, allowing for potential information disclosure through an out-of-bounds read. Users are strongly advised to update their devices to the latest version to protect against this issue.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2024-56185 is a vulnerability in the ProtocolCallAdapter of Android Pixel-family devices that allows for a possible out-of-bounds read, leading to local information disclosure.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If your device is affected, you should update to the patched version available as of March 5, 2025, to mitigate the risk associated with this vulnerability.
No, user interaction is not needed for the exploitation of this vulnerability, making it particularly concerning.
The potential consequences include local information disclosure, which could expose sensitive data if the baseband firmware is compromised.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
