Cyber Resilience

CVE-2024-20060

Google Android 12.0 … 14.0

Published
06 May 2024
Modified
30 April 2025
Patch / advisory
CVSS Score v3.1 5.9
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0011 1th percentile
Risk Priority 43 floored blend · peak EPSS

Summary

CVE-2024-20060 is a medium-severity Improper Handling of Faults that Lead to Instruction Skips (CWE-1332) vulnerability in Google Android. Its CVSS base score is 5.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Pre-OS Boot (T1542); ranked at the 1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-18 (Tamper Resistance and Detection) and SR-9 (Tamper Resistance and Detection) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

In da, there is a possible escalation of privilege due to an incorrect status check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08541749; Issue ID:…

more

ALPS08541754.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1542 Pre-OS Boot Stealth
Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system.
T1553.002 Code Signing Defense Impairment
Adversaries may create, acquire, or steal code signing materials to sign their malware or tools.
T1542.001 System Firmware Stealth
Adversaries may modify system firmware to persist on systems.
T1542.003 Bootkit Stealth
Adversaries may use bootkits to persist on systems.
T1548 Abuse Elevation Control Mechanism Privilege Escalation
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions.
T1553 Subvert Trust Controls Defense Impairment
Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-32860Same product: Google Android
CVE-2023-32853Same product: Google Android
CVE-2023-32866Same product: Google Android
CVE-2024-20038Same product: Google Android
CVE-2024-20074Same product: Google Android
CVE-2023-32863Same product: Google Android
CVE-2023-32867Same product: Google Android
CVE-2023-32862Same product: Google Android
CVE-2023-32868Same product: Google Android
CVE-2023-32869Same product: Google Android

Affected Assets

google
android
12.0, 13.0, 14.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Tamper resistance and detection requirements prevent the absence of fault-handling mechanisms for instruction-skipping attacks.

Tamper protection program directly requires circuitry/sensors to detect and respond to physical fault injection that produces instruction skips.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-03 mostly match
prevents

Replacing hardware that lacks required security capabilities (e.g., fault sensors) directly mitigates the described weakness.

PR.IR-02 partial match
prevents

Protecting assets from environmental threats can reduce fault-injection opportunities that cause instruction skips.

PR.IR-03 partial match
prevents

Resilience mechanisms can include hardware-level fault detection and recovery that directly address instruction skips.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Secure system architecture and engineering principles can require hardware-level fault detection and instruction-integrity mechanisms.

degrades

Secure coding guidelines may mandate defensive coding against skipped instructions, but do not address underlying hardware circuitry.

finds

Security testing in development can discover instruction-skip faults, yet testing alone does not guarantee hardware-level mitigation.

References