CVE-2024-32896
Android Pixel Privilege Escalation Vulnerability
Description
CVE-2024-32896 is a high-severity elevation of privilege vulnerability in Google Android, specifically affecting Pixel devices. The flaw stems from a logic error in the code that allows an attacker to bypass security controls and escalate privileges locally without requiring additional execution privileges. With a CVSS v3.1 score of 7.8, exploitation requires user interaction. CISA added CVE-2024-32896 to the Known Exploited Vulnerabilities catalog with a remediation deadline of July 4, 2024. The EPSS score of 0.18% at the 39.4th percentile reflects relatively low broad exploitation probability, suggesting the attacks may be targeted rather than opportunistic.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| android | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://source.android.com/security/bulletin/pixel/2024-06-01(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-32896(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2024-32896. The vulnerability description identifies a logic error in the code that enables a security bypass leading to privilege escalation. Logic errors in Android typically correspond to CWE-840 (Business Logic Errors) or CWE-863 (Incorrect Authorization), where the system fails to properly enforce its intended security policy. The exact technical mechanism has not been publicly detailed by Google, but the advisory confirms that the flaw allows bypassing a security control that should prevent privilege escalation.
Impact Analysis
CVE-2024-32896 enables local escalation of privilege on affected Android Pixel devices. The CVSS vector indicates a Local attack (AV:L) with Low complexity (AC:L) and No privileges required (PR:N), though User Interaction is Required (UI:R). This means the attacker needs to trick the user into performing some action, such as installing a malicious application or opening a crafted file, but does not need any existing privileges on the device. Confidentiality (High): a successful exploit gives the attacker access to all data on the device, including contacts, messages, photos, authentication tokens, and credentials stored in the secure keystore. Integrity (High): the attacker can modify system settings, install persistent malware, alter application data, and potentially disable security features such as device encryption or lockscreen protections. Availability (High): the attacker can render the device unusable, wipe data, or lock the user out. The relatively low EPSS score of 0.18% at the 39.4th percentile suggests that exploitation is targeted rather than mass-scale, which is consistent with the focused nature of Pixel-specific vulnerabilities. The ransomware association is listed as unknown.
Exploit Maturity
CVE-2024-32896 has confirmed active exploitation in the wild, leading CISA to add it to the KEV catalog with a remediation deadline of July 4, 2024. Google disclosed the vulnerability in the June 2024 Pixel security bulletin, noting that there were indications of limited, targeted exploitation. The relatively low EPSS score of 0.18% at the 39.4th percentile is consistent with targeted attacks rather than widespread exploitation, which is typical for vulnerabilities used against specific individuals or organizations (such as journalists, activists, or government officials). While no public exploit code has been widely circulated, the confirmed in-the-wild exploitation indicates that threat actors have developed working exploits. The ransomware status is listed as unknown.
Remediation
-
Apply the June 2024 Android security update on all Pixel devices. Google addressed CVE-2024-32896 in the June 2024 Pixel security bulletin. Ensure that automatic updates are enabled and verify the security patch level is June 2024 or later.
-
Enforce security update policies across managed Pixel device fleets using mobile device management (MDM) solutions. Set compliance policies that require devices to have the June 2024 security patch level or later, and restrict access to corporate resources for non-compliant devices.
-
Educate users about the social engineering component of this vulnerability. Since user interaction is required, the attack likely relies on convincing the victim to install a malicious app or open a crafted file. Reinforce policies against installing apps from unknown sources and opening unsolicited files.
-
Monitor for indicators of compromise on Pixel devices, particularly devices belonging to high-value targets such as executives, security personnel, or individuals handling sensitive information. Look for unexpected app installations, unusual device behavior, and anomalous data transfers.
-
Enable Google Play Protect on all devices to provide an additional layer of defense against malicious applications that may attempt to exploit this vulnerability. Ensure that the "Improve harmful app detection" setting is enabled to share unknown apps with Google for analysis.
Technical Details
CVE-2024-32896 is an elevation of privilege vulnerability in Google Android (Pixel) with a CVSS v3.1 vector of CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, yielding a score of 7.8 (High). The Attack Vector is Local (AV:L), meaning the exploit runs on the device itself, typically through a malicious application. Attack Complexity is Low (AC:L), indicating no special conditions are needed beyond user interaction. Privileges Required is None (PR:N), so the attacking application does not need any special Android permissions to trigger the vulnerability. User Interaction is Required (UI:R), meaning the user must perform some action such as installing an app or opening a file. The Scope is Unchanged (S:U), and all three impact metrics are High. The vulnerability is described as a logic error that allows bypassing a security mechanism, leading to local privilege escalation. In the Android security model, this type of flaw typically exists in a system service or framework component where an incorrect conditional check, missing validation, or improper state handling allows an unprivileged process to gain elevated capabilities. The affected product is listed generically as Google Android, but the vulnerability was specifically addressed in the Pixel security bulletin, indicating it may involve Pixel-specific firmware or software components.
Frequently Asked Questions
Is CVE-2024-32896 being actively exploited?
Yes. Google acknowledged limited, targeted exploitation of CVE-2024-32896 in the wild, and CISA added it to the KEV catalog. The targeted nature suggests use against specific individuals rather than mass exploitation.
What devices are affected by CVE-2024-32896?
The vulnerability was disclosed in the June 2024 Pixel security bulletin and affects Google Pixel devices. While listed generically under Android, the fix was delivered through the Pixel-specific security update channel, suggesting Pixel-specific components are involved.
Does CVE-2024-32896 require physical access to the device?
No, but it requires local code execution and user interaction. The most likely attack scenario involves a malicious application that the user is tricked into installing. The app can then exploit the vulnerability without requiring any special Android permissions.
How do I fix CVE-2024-32896?
Apply the June 2024 Pixel security update from Google. Navigate to Settings > Security > Security update and verify the patch level is June 2024 or later. Enable automatic updates to ensure future security patches are applied promptly.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.