CVE-2024-29745
Android Pixel Information Disclosure Vulnerability
Description
CVE-2024-29745 is a medium-severity information disclosure vulnerability in Google Android Pixel devices caused by the use of uninitialized data. With a CVSS v3.1 base score of 5.5, this flaw allows a local attacker to access sensitive information from memory regions that were not properly initialized before use, without requiring any user interaction. CISA added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of April 25, 2024, and its ransomware association is classified as unknown. The EPSS score of 0.21% at the 42.5th percentile reflects the local attack vector, but CISA's KEV listing confirms active real-world exploitation. The vulnerability was addressed in the Android Pixel security bulletin dated April 1, 2024.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| android | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://source.android.com/security/bulletin/pixel/2024-04-01(Vendor Advisory)
- https://twitter.com/GrapheneOS/status/1775306481622995226(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-29745(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2024-29745 by NVD. Based on the vulnerability description, this is an uninitialized data vulnerability (typically classified as CWE-908: Use of Uninitialized Resource). The flaw occurs when memory or data structures are allocated but not properly initialized (zeroed out) before being used or returned to the caller. In the Pixel device context, this means that memory regions may contain residual sensitive data from previous operations, such as cryptographic keys, authentication tokens, portions of user data, or internal system state. When the uninitialized memory is read, this residual data is disclosed to the attacker. Uninitialized data vulnerabilities in mobile device firmware can be particularly sensitive because they may expose data protected by hardware security modules or trusted execution environments.
Impact Analysis
The impact of CVE-2024-29745 is focused on confidentiality, reflecting the information disclosure nature of the vulnerability. Confidentiality is highly impacted because uninitialized data on a Pixel device may contain fragments of cryptographic keys, authentication tokens, biometric data references, encryption state from the Titan M security chip, or portions of user data that were processed in the same memory regions. The specific data exposed depends on what previously occupied the uninitialized memory, making the disclosure somewhat unpredictable but potentially extremely sensitive.
Integrity and availability are not directly affected by this vulnerability in isolation. However, disclosed information can serve as a critical enabler for subsequent attacks. Leaked cryptographic material may allow decryption of protected data, exposed memory layout information defeats ASLR, and disclosed authentication tokens can enable impersonation. The EPSS score of 0.21% at the 42.5nd percentile is relatively modest, but CISA's KEV listing confirms that this vulnerability is being exploited despite its local attack requirements. The exploitation pattern suggests targeted use by forensic tool vendors or advanced threat actors who combine this information disclosure with other vulnerabilities (such as the companion CVE-2024-29748 privilege escalation) to build complete exploitation chains against specific Pixel device targets.
Exploit Maturity
CVE-2024-29745 has confirmed active exploitation, validated by CISA's KEV listing with an April 25, 2024 remediation deadline. The EPSS score of 0.21% at the 42.5th percentile is modest but reflects the local attack vector requirement rather than lack of exploitation activity.
The vulnerability was disclosed in the Android Pixel Security Bulletin April 2024 alongside the companion privilege escalation vulnerability CVE-2024-29748. GrapheneOS independently documented the exploitation of both vulnerabilities, confirming that they were being used in active attacks against Pixel devices. The combination of an information disclosure vulnerability with a privilege escalation flaw in the same bulletin suggests these were being chained together in exploitation campaigns, with CVE-2024-29745 providing the necessary information leakage to enable or enhance the CVE-2024-29748 privilege escalation. This exploitation pattern is characteristic of mobile forensics tools used by law enforcement and intelligence agencies, which commonly chain multiple vulnerabilities to extract data from locked devices.
Remediation
-
Install the April 2024 Pixel security update immediately as referenced in the Pixel Security Bulletin. Navigate to Settings > System > System update on your Pixel device and apply all available updates. Ensure the security patch level reaches at least 2024-04-05 to address both this vulnerability and the related CVE-2024-29748.
-
Enable automatic security updates on all Pixel devices to ensure timely application of future security patches. Go to Settings > System > System update > System update preferences and configure automatic updates. Pixel devices receive security updates directly from Google, typically with monthly cadence.
-
Minimize the local attack surface by reviewing installed applications and removing any that are unnecessary or from untrusted sources. The local attack vector means exploitation requires code execution on the device, most commonly through a malicious application. Check Settings > Security > Device admin apps to ensure no unexpected applications have device administrator privileges.
-
Enable Google Play Protect and verify it is actively scanning installed applications. Navigate to Google Play Store > Play Protect to check the scan status and ensure real-time protection is active. This helps detect applications that may attempt to exploit this and other local vulnerabilities.
-
Assess exposure for high-security users who may be targeted by advanced threat actors or forensic tools. Individuals handling sensitive data, government officials, journalists, and activists should treat both CVE-2024-29745 and CVE-2024-29748 as high-priority patches. Consider using GrapheneOS or other hardened Android distributions that may provide additional mitigations against these classes of vulnerabilities.
Technical Details
CVE-2024-29745 is an information disclosure vulnerability in Google Android Pixel devices, characterized by the CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vector reflects a local confidentiality-only impact. Attack Vector (AV:L) indicates the attacker needs local access, typically through a malicious application or physical device access. Attack Complexity (AC:L) means the information disclosure is reliable and does not require special conditions or timing. Privileges Required (PR:L) indicates some level of authenticated access is needed, such as a standard Android application sandbox. User Interaction (UI:N) confirms the disclosure can occur without any action from the device user. Scope (S:U) remains unchanged. Only Confidentiality (C:H) is impacted, with no effect on integrity or availability.
The vulnerability involves the use of uninitialized data in Pixel-specific firmware or driver components. When memory is allocated for data structures or buffers, the operating system or firmware does not guarantee that the memory is zeroed out before use. This allocated memory may contain residual data from previous operations, including sensitive information such as cryptographic keys, session tokens, kernel memory contents, or user data fragments. The Pixel-specific nature of this vulnerability suggests it exists in proprietary Google firmware components such as the bootloader, Titan M security chip interface, or device-specific kernel drivers rather than the general Android codebase. The combination of local information disclosure with no user interaction makes this vulnerability well-suited for inclusion in exploit chains where leaked information (memory addresses, cryptographic state, or internal data structures) enables subsequent privilege escalation through vulnerabilities like CVE-2024-29748.
Frequently Asked Questions
What is CVE-2024-29745?
CVE-2024-29745 is an information disclosure vulnerability in Google Pixel devices caused by uninitialized data. It allows a local attacker with low privileges to read sensitive information from memory without any user interaction. Despite its medium CVSS score of 5.5, it is listed in CISA's KEV catalog confirming active exploitation.
What kind of information can be disclosed through this vulnerability?
Uninitialized memory on a Pixel device may contain residual sensitive data from previous operations, including cryptographic key material, authentication tokens, portions of user data, or internal device state information. The specific data exposed depends on what previously occupied the affected memory regions.
Why is a medium-severity vulnerability in CISA's KEV catalog?
CISA's KEV catalog inclusion is based on confirmed active exploitation, regardless of CVSS score. CVE-2024-29745 is believed to be exploited in combination with CVE-2024-29748 (a privilege escalation vulnerability), where the information disclosure provides data needed to complete the exploitation chain.
Does this affect all Android phones or only Pixel devices?
This vulnerability is specific to Google Pixel devices and was disclosed in the Pixel-specific security bulletin, not the general Android security bulletin. The flaw exists in Pixel-exclusive firmware or driver components, so other Android device manufacturers are not affected by this particular issue.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.