CVE-2024-29748
Android Pixel Privilege Escalation Vulnerability
Description
CVE-2024-29748 is a high-severity local privilege escalation vulnerability in Google Android Pixel devices caused by a logic error that allows bypassing security protections. With a CVSS v3.1 base score of 7.8, this flaw enables a local attacker to escalate privileges without requiring any additional execution privileges, though user interaction is needed for exploitation. CISA added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of April 25, 2024, and its ransomware association is classified as unknown. The EPSS score of 0.38% at the 59.2nd percentile indicates moderate but confirmed exploitation activity. The vulnerability was addressed in the Android Pixel security bulletin dated April 1, 2024.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| android | < 2024-04-05 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://source.android.com/security/bulletin/pixel/2024-04-01(Vendor Advisory)
- https://twitter.com/GrapheneOS/status/1775308208472813609(Broken Link, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-29748(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2024-29748 by NVD. Based on the vulnerability description, this is a logic error that allows bypassing a security mechanism on Pixel devices. The flaw exists in the device's security enforcement logic, where an incorrect conditional check or missing validation step allows an attacker to circumvent protections that would normally prevent privilege escalation. Logic errors of this nature are particularly insidious because they do not involve traditional memory corruption or injection patterns, making them harder to detect through automated analysis tools. The bypass mechanism requires some form of user interaction, suggesting it may involve a UI-based security control that can be manipulated through social engineering or a malicious application prompting specific user actions.
Impact Analysis
The impact of CVE-2024-29748 affects all three dimensions of the CIA triad on compromised Pixel devices. Confidentiality is fully compromised because local privilege escalation on an Android device grants access to data that is normally sandboxed between applications, including messages, emails, photos, browsing history, saved credentials, and data from banking and authentication applications. On Pixel devices specifically, this may bypass the Titan M security chip's protections that guard the most sensitive cryptographic operations and credential storage.
Integrity faces high impact as elevated privileges allow the attacker to modify system-level configurations, install persistent backdoors that survive application removal, tamper with security settings, and modify other applications' data. The attacker could install a rootkit or modify the system partition to maintain persistent access even after the initial exploit application is removed.
Availability is significantly affected because the attacker can leverage elevated privileges to lock the user out of their device, corrupt data, disable security features, or render the device inoperable. The EPSS score of 0.38% at the 59.2nd percentile, while lower than network-exploitable vulnerabilities, still represents meaningful exploitation activity given the physical or app-based access requirements. GrapheneOS, the privacy-focused Android distribution, independently confirmed this vulnerability's exploitation, lending additional credibility to the active exploitation assessment. The requirement for user interaction may limit mass exploitation but makes it well-suited for targeted attacks against specific individuals.
Exploit Maturity
CVE-2024-29748 has confirmed active exploitation with independent verification from multiple sources. CISA's inclusion in the KEV catalog with an April 25, 2024 deadline validates real-world exploitation. The EPSS score of 0.38% at the 59.2nd percentile reflects the local attack vector requirement, which naturally limits exploitation scale compared to network-accessible vulnerabilities.
The vulnerability was disclosed in the Android Pixel Security Bulletin April 2024, which provides the official advisory and patch information. GrapheneOS independently confirmed exploitation activity via their security research, providing additional corroboration of active in-the-wild use. The fact that this vulnerability was being exploited prior to the April 2024 patch suggests zero-day or near-zero-day exploitation, likely by forensic tool vendors or sophisticated threat actors targeting specific individuals. Pixel device vulnerabilities that bypass security protections are particularly valuable in the surveillance and forensics ecosystem, where they enable extraction of data from locked or encrypted devices.
Remediation
-
Install the April 2024 Pixel security update immediately as referenced in the Pixel Security Bulletin. Navigate to Settings > System > System update on your Pixel device and apply all available updates. The patch level should be at or after 2024-04-05 to address this vulnerability.
-
Enable automatic security updates on all Pixel devices to ensure future security patches are applied promptly. Go to Settings > System > System update > System update preferences and enable automatic updates. Given the confirmed active exploitation of Pixel-specific vulnerabilities, delays in applying security updates create meaningful risk.
-
Review installed applications for suspicious or untrusted software since the vulnerability requires some form of user interaction, likely through a malicious application. Remove any applications that were not installed from the Google Play Store or other trusted sources. Check Settings > Apps for any unfamiliar applications, paying attention to applications that request unusual permissions.
-
Enable Google Play Protect and run a security scan to detect potentially harmful applications that may attempt to exploit this vulnerability. Navigate to Google Play Store > Play Protect > Scan and verify that Play Protect is active and the device passes the security check. Also review the companion vulnerability CVE-2024-29745 (information disclosure) which was disclosed in the same security bulletin.
-
Consider a factory reset for high-value targets if there is any indication that the device may have been compromised before patching. A factory reset followed by applying the latest security update and restoring from a known-clean backup provides the highest assurance of removing any persistent compromise. This is particularly recommended for devices used to access sensitive corporate or government resources.
Technical Details
CVE-2024-29748 is a local privilege escalation vulnerability in Google Android Pixel devices, characterized by the CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vector components describe a locally exploitable flaw with specific exploitation conditions. Attack Vector (AV:L) indicates the attacker needs local access, typically through a malicious application installed on the device. Attack Complexity (AC:L) means the exploit works reliably without requiring special conditions. Privileges Required (PR:N) indicates no special privileges are needed beyond the ability to run code on the device, meaning a standard unprivileged application can trigger the exploit. User Interaction (UI:R) is the key distinguishing factor, indicating the victim must perform some action such as granting a permission, clicking a prompt, or interacting with a UI element presented by the exploiting application. Scope (S:U) remains unchanged within the device context.
The vulnerability is described as a logic error that allows bypassing an unspecified security mechanism on Pixel devices. Logic errors differ from memory corruption vulnerabilities in that they exploit flawed program logic rather than buffer overflows or use-after-free conditions. In the context of Android's security model, this likely involves bypassing a permission check, SELinux policy enforcement, or a security boundary between application sandboxes. The bypass mechanism could target the device's secure boot chain, TEE (Trusted Execution Environment) interactions, or the Titan M security chip's verification processes. The fact that this is Pixel-specific (not affecting the broader Android ecosystem) suggests the vulnerability exists in Pixel-exclusive firmware or bootloader components rather than the Android Open Source Project codebase. Affected devices are those running Android versions prior to the April 5, 2024 security patch level.
Frequently Asked Questions
What is CVE-2024-29748?
CVE-2024-29748 is a privilege escalation vulnerability in Google Pixel devices caused by a logic error that allows bypassing security protections. With a CVSS score of 7.8, it enables a local attacker to gain elevated privileges, though some user interaction is required for exploitation.
Is this vulnerability specific to Pixel devices or does it affect all Android devices?
This vulnerability is specific to Google Pixel devices and was disclosed in the Pixel-specific security bulletin, not the general Android security bulletin. Other Android device manufacturers are not affected by this particular flaw, though they may have their own device-specific vulnerabilities.
How do I check if my Pixel device is patched?
Go to Settings > About phone > Android version and check the Security patch level. If it shows April 5, 2024 or later, your device is patched against this vulnerability. If not, go to Settings > System > System update to check for available updates.
Is CVE-2024-29748 related to CVE-2024-29745?
Both vulnerabilities were disclosed in the same April 2024 Pixel security bulletin and both were confirmed as actively exploited. CVE-2024-29745 is an information disclosure vulnerability while CVE-2024-29748 is a privilege escalation flaw. They may have been exploited together in attack chains targeting Pixel devices.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.