CVE-2024-20060
Google Android 12.0 … 14.0
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LSummary
CVE-2024-20060 is a medium-severity Improper Handling of Faults that Lead to Instruction Skips (CWE-1332) vulnerability in Google Android. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Pre-OS Boot (T1542); ranked at the 1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-18 (Tamper Resistance and Detection) and SR-9 (Tamper Resistance and Detection) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-17775
Vulnerability Data
In da, there is a possible escalation of privilege due to an incorrect status check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08541749; Issue ID:…
more
ALPS08541754.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Tamper resistance and detection requirements prevent the absence of fault-handling mechanisms for instruction-skipping attacks.
Tamper protection program directly requires circuitry/sensors to detect and respond to physical fault injection that produces instruction skips.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Replacing hardware that lacks required security capabilities (e.g., fault sensors) directly mitigates the described weakness.
Protecting assets from environmental threats can reduce fault-injection opportunities that cause instruction skips.
Resilience mechanisms can include hardware-level fault detection and recovery that directly address instruction skips.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure system architecture and engineering principles can require hardware-level fault detection and instruction-integrity mechanisms.
Secure coding guidelines may mandate defensive coding against skipped instructions, but do not address underlying hardware circuitry.
Security testing in development can discover instruction-skip faults, yet testing alone does not guarantee hardware-level mitigation.