CVE-2024-56186: Android Pixel-family Secure Element Out of Bounds Read Vulnerability
Summary
CVE-2024-56186: In closeChannel of secureelementimpl.cpp, there is a possible out of bounds read due to an incorrect bounds check. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2025-03-05. Fixed in Pixel-family specific:2025-03-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The affected package is part of the Android ecosystem, specifically within the Pixel-family devices. This package is responsible for managing secure elements, which are crucial for handling sensitive data and ensuring secure transactions. The vulnerability arises from an incorrect bounds check in the closeChannel function of secureelementimpl.cpp, potentially exposing sensitive information.
Vulnerability Detail
In the closeChannel function of secureelementimpl.cpp, there exists a possible out of bounds read due to an incorrect bounds check. This vulnerability can lead to local information disclosure without requiring additional execution privileges. Exploitation does not necessitate user interaction, making it a significant security concern for affected devices.
How To Fix
Minimum fixed version
Pixel-family specific:2025-03-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2024-56186 is a significant vulnerability affecting the secure element implementation in Pixel-family Android devices. Users are advised to update their devices to the patched version as soon as it is available to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for :unknown: →
FAQ
The vulnerability affects Pixel-family devices running the specific version of the Android ecosystem where the vulnerability exists.
The primary risk is local information disclosure, which could expose sensitive data without requiring additional privileges.
No, user interaction is not needed for exploitation, making it a more serious security issue.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is advisable to monitor your device for updates and apply them as soon as they are available.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
