CVE-2024-56189: SAEMM_RadioMessageCodec Out of Bounds Read Vulnerability
Summary
CVE-2024-56189: In SAEMM_DiscloseMsId of SAEMM_RadioMessageCodec.c, there is a possible out of bounds read due to a missing bounds check. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2025-04-05. Fixed in Pixel-family specific:2025-04-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SAEMM_RadioMessageCodec is a component used in Android systems, particularly within Pixel devices, for handling radio messages. It plays a crucial role in communication between the device and network services. However, this component has been identified to have a vulnerability that could potentially expose sensitive information.
Vulnerability Detail
In SAEMM_DiscloseMsId of SAEMM_RadioMessageCodec.c, there is a possible out of bounds read due to a missing bounds check. This vulnerability can lead to remote information disclosure after authentication, meaning that an attacker could access sensitive data without needing additional execution privileges. User interaction is not required for exploitation, making this a significant security concern.
How To Fix
Minimum fixed version
Pixel-family specific:2025-04-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the available patch by updating the system.
Conclusion
The CVE-2024-56189 vulnerability in SAEMM_RadioMessageCodec poses a serious risk of information disclosure due to an out of bounds read. Users are strongly advised to update their devices to the latest patched version to protect against potential exploitation.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2024-56189 is a vulnerability in the SAEMM_RadioMessageCodec component of Android that allows for out of bounds reading, potentially leading to information disclosure.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If your device is affected, ensure to update to the patched version released on April 5, 2025, to mitigate the vulnerability.
No, user interaction is not needed for exploitation, making this vulnerability particularly concerning.
The potential consequences include unauthorized access to sensitive information, which could lead to privacy breaches.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
