CVE-2024-47032
Published: 03 January 2025
Summary
CVE-2024-47032 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 9.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-47032 is a heap buffer overflow vulnerability stemming from an out-of-bounds write in the construct_transaction_from_cmd function within lwis_ioctl.c. This flaw affects Android devices, particularly Google Pixel models as detailed in the associated security bulletin. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is classified under CWE-120 (Buffer Copy without Checking Size of Input).
A local attacker with low-privilege access can exploit this vulnerability without requiring user interaction or additional execution privileges. Successful exploitation enables escalation of privileges, potentially granting full control over the affected device with high impacts on confidentiality, integrity, and availability.
The Android Pixel security bulletin from December 1, 2024 (https://source.android.com/security/bulletin/pixel/2024-12-01) addresses this issue, recommending users apply the provided patches to mitigate the risk.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-42859
Vulnerability details
In construct_transaction_from_cmd of lwis_ioctl.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local heap buffer overflow in kernel ioctl handler directly enables privilege escalation from low-privileged local access to full device control.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Memory protection mechanisms such as heap canaries, ASLR, and non-executable memory directly mitigate exploitation of heap buffer overflows like this out-of-bounds write.
Flaw remediation ensures timely patching of the specific heap buffer overflow vulnerability as recommended in the Android Pixel security bulletin.
Information input validation addresses the root cause of CWE-120 by enforcing checks on command sizes in functions like construct_transaction_from_cmd.