Google fixed two actively exploited Pixel vulnerabilities
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-29748 +1 in the same advisory: …29745 | Local Privilege Escalation in Google Pixel (Android), Exploited in the Wild Google Pixel devices running affected Android software contain a privilege escalation flaw (CVE-2024-29748) caused by a logic error that allows a security bypass. Exploitation is local to the device and requires user interaction, but the attacker needs no additional execution privileges to complete the escalation. A successful exploit grants the attacker elevated privileges on the device with high impact on confidentiality, integrity, and availability. All unpatched Google Android Pixel devices are affected; the source data does not specify exact affected version ranges. The flaw is being exploited in the wild: CISA added it to the KEV catalog on 2024-04-04, and press reporting describes Google patching actively exploited Pixel zero-day flaws, with reporting tying the exploitation to forensic/phone-cracking companies. Do: Update Pixel devices with Google's latest Android security update and verify the Android security patch level is April 2024 or later in Settings > About phone; this is a CISA KEV entry, so apply vendor mitigations promptly or discontinue use per the KEV required action. Because exploitation requires local access and user interaction, restrict device access to untrusted parties and avoid side-loading untrusted apps on unpatched devices. No public proof-of-concept is known, but active exploitation means patching should not wait. | 7.8 group max | <1% | KEV |
| mass≈tens of millions of Pixel smartphones (estimated active install base; only devices not yet on the vendor's security update are exploitable) |
Full article228 words · extracted from securityaffairs.com · click to collapse
Google addressed several vulnerabilities in Android and Pixel devices, including two actively exploited flaws.
Google addressed 28 vulnerabilities in Android and 25 flaws in Pixel devices. Two issues fixed by the IT giant, tracked as CVE-2024-29745 and CVE-2024-29748, are actively exploited in the wild.
The most critical flaw addressed by the company impacts the System component, it is a local privilege escalation that doesn’t require any additional execution privileges.
“The most severe of these issues is a high security vulnerability in the System component that could lead to local escalation of privilege with no additional execution privileges needed.” reads the Android Security Bulletin—April 2024.
“There are indications that the following may be under limited, targeted exploitation.” reads the advisory.
- CVE-2024-29745
- CVE-2024-29748″
The company did not provide details about the attacks, but in the past such kind of bugs was actively exploited by nation-state actors or commercial spyware vendors.
CVE-2024-29745 is a High severity Information disclosure issue in the bootloader, while CVE-2024-29748 is a High severity elevation of privilege issues in the Pixel Firmware.
The 2024-04-01 security patch level addressed eight high-severity flaws in Framework and System. Addressed issues includes elevation of privileges, information leak, and denial-of-service flaw.
The 2024-04-05 security patch level addressed 20 vulnerabilities in MediaTek, Widevine, and Qualcomm components.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Android)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/161428/security/google-fixed-actively-exploited-pixel-flaws.html