CVE-2024-56187: Android Pixel Family Arbitrary Read Vulnerability in ppcfw
Summary
CVE-2024-56187: In ppcfw_deny_sec_dram_access of ppcfw.c, there is a possible arbitrary read from TEE memory due to a logic error in the code. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2025-03-05. Fixed in Pixel-family specific:2025-03-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ppcfw package is a critical component of the Android operating system, specifically designed for managing secure access to system resources. It plays a vital role in ensuring that sensitive operations are performed securely within the Trusted Execution Environment (TEE). However, a logic error in the code has introduced a vulnerability that could allow unauthorized access to sensitive information stored in memory.
Vulnerability Detail
In the function ppcfw_deny_sec_dram_access within ppcfw.c, a logic error has been identified that allows for arbitrary read access from TEE memory. This vulnerability can lead to local information disclosure, meaning that an attacker with system execution privileges could exploit this flaw to gain access to sensitive data without requiring user interaction. The implications of this vulnerability are significant, as it could expose critical information that is meant to be protected within the secure environment of the TEE.
How To Fix
Minimum fixed version
Pixel-family specific:2025-03-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available to mitigate this vulnerability without applying the patch. Users are advised to update to the latest version as soon as it becomes available.
Conclusion
The CVE-2024-56187 vulnerability in the ppcfw package poses a significant risk of information disclosure for users of Pixel-family Android devices. It is crucial to update to the patched version as soon as it becomes available to mitigate this risk.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2024-56187 is a vulnerability in the ppcfw package of the Android operating system that allows for arbitrary read access from TEE memory due to a logic error.
This vulnerability affects users of Pixel-family Android devices that utilize the ppcfw package.
The vulnerability could lead to local information disclosure, allowing attackers with system execution privileges to access sensitive data.
The best way to protect your device is to update to the patched version of the ppcfw package, available from March 5, 2025.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
