CVE-2024-32896: Android Pixel Privilege Escalation Vulnerability
Android Pixel contains an unspecified vulnerability in the firmware that allows for privilege escalation.
Other sources
In rebootRecoveryWithCommand of RecoverySystemService.java, there is a possible way to bypass a factory reset due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
— OSV
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/build/soongto a version that resolves this vulnerability.Fixed in 15-next:2024-09-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 15-next:2024-09-01 - Upgrade
Upgrade
android/platform/hardware/interfacesto a version that resolves this vulnerability.Fixed in 15-next:2024-09-01 - Upgrade
Upgrade
android/platform/system/sepolicyto a version that resolves this vulnerability.Fixed in 15-next:2024-09-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 12:2024-09-01 - Upgrade
Upgrade
android/platform/system/sepolicyto a version that resolves this vulnerability.Fixed in 12:2024-09-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 12L:2024-09-01 - Upgrade
Upgrade
android/platform/system/sepolicyto a version that resolves this vulnerability.Fixed in 12L:2024-09-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 13:2024-09-01 - Upgrade
Upgrade
android/platform/system/sepolicyto a version that resolves this vulnerability.Fixed in 13:2024-09-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 14:2024-09-01 - Upgrade
Upgrade
android/platform/system/sepolicyto a version that resolves this vulnerability.Fixed in 14:2024-09-01 - Upgrade
Upgrade
android/platform/build/soongto a version that resolves this vulnerability.Fixed in 14-next:2024-06-05 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 14-next:2024-06-05 - Upgrade
Upgrade
android/platform/hardware/interfacesto a version that resolves this vulnerability.Fixed in 14-next:2024-06-05 - Upgrade
Upgrade
android/platform/system/sepolicyto a version that resolves this vulnerability.Fixed in 14-next:2024-06-05 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 14:2024-06-05 - Upgrade
Upgrade
android/platform/system/sepolicyto a version that resolves this vulnerability.Fixed in 14:2024-06-05
Event History
Frequently Asked Questions
What is the severity of CVE-2024-32896?
CVE-2024-32896 has been classified with a high severity rating due to its potential for privilege escalation.
How do I fix CVE-2024-32896?
To resolve CVE-2024-32896, ensure that your Android Pixel device is updated to the latest firmware version provided by Google.
What types of devices are affected by CVE-2024-32896?
CVE-2024-32896 affects Google Pixel devices running the vulnerable version of the Android firmware.
What can attackers achieve by exploiting CVE-2024-32896?
Exploiting CVE-2024-32896 allows attackers to achieve local privilege escalation on the affected Android Pixel devices.
Is user interaction required to exploit CVE-2024-32896?
No, CVE-2024-32896 can be exploited without requiring user interaction.