CVE-2024-49738
Published: 21 January 2025
Summary
CVE-2024-49738 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 17.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2024-49738 is a vulnerability involving a possible out-of-bounds write in the writeInplace function of Parcel.cpp. This issue affects the Android operating system, specifically the Parcel component used for inter-process communication. Assigned CWE-787, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-01-21.
The vulnerability enables local escalation of privilege without requiring additional execution privileges or user interaction. An attacker with low-privilege local access (PR:L) can exploit it due to low attack complexity (AC:L), potentially achieving high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) by overwriting memory beyond intended bounds.
The Android security bulletin at https://source.android.com/security/bulletin/2025-01-01 provides details on affected versions and patches for mitigation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-43701
Vulnerability details
In writeInplace of Parcel.cpp, there is a possible out of bounds write. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write in Android Parcel IPC directly enables local privilege escalation via memory corruption (CWE-787).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates timely identification, reporting, and patching of flaws like the out-of-bounds write in Parcel.cpp as addressed in the Android security bulletin.
Implements memory protection mechanisms such as address space layout randomization and data execution prevention to mitigate exploitation of the out-of-bounds write vulnerability.
Requires validation of inputs to functions like writeInplace in Parcel.cpp to prevent out-of-bounds writes from invalid sizes or offsets.