CVE-2024-40649
Published: 28 January 2025
Summary
CVE-2024-40649 is a high-severity Use After Free (CWE-416) vulnerability in Google Android. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 9.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-40649 is a use-after-free vulnerability caused by a logic error in the code within TBD of TBD. It affects the kernel, as referenced in the Android Security Bulletin, and could lead to local escalation of privilege with no additional execution privileges required. The vulnerability is associated with CWE-416 and has a CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high impact potential from a local attack vector.
An unprivileged local attacker can exploit this vulnerability without user interaction or elevated privileges beforehand. Successful exploitation allows escalation of privileges within the kernel, granting the attacker high levels of control over confidentiality, integrity, and availability of the affected system.
The Android Security Bulletin for October 2024, available at https://source.android.com/security/bulletin/2024-10-01, provides information on patches and mitigation measures for this vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38847
Vulnerability details
In TBD of TBD, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for…
more
exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Kernel use-after-free vulnerability directly enables local privilege escalation (T1068) with no prior access required.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2024-40649 by requiring timely patching of the kernel use-after-free vulnerability as detailed in the Android Security Bulletin.
Implements memory protection mechanisms that prevent exploitation of the kernel use-after-free logic error by enforcing isolation and access controls on memory.
Hardens kernel configuration settings to enable memory safety features and mitigations that reduce the exploitability of use-after-free vulnerabilities.