CVE-2024-49745
Published: 21 January 2025
Summary
CVE-2024-49745 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 21.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires identification, reporting, and timely patching of flaws like the incorrect bounds check in growData of Parcel.cpp to eliminate the out-of-bounds write vulnerability enabling local privilege escalation.
Implements memory protection mechanisms such as non-executable memory and stack guards that mitigate exploitation of the out-of-bounds write for arbitrary code execution and privilege escalation.
Provides vulnerability scanning to identify systems affected by CVE-2024-49745 in Android Parcel handling, enabling prioritization of remediation efforts.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write in Android Binder IPC parcel handling directly enables local privilege escalation via memory corruption exploitation.
NVD Description
In growData of Parcel.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Deeper analysisAI
CVE-2024-49745 is a vulnerability in the growData function of Parcel.cpp, where an incorrect bounds check can lead to an out-of-bounds write (CWE-787). This issue affects the Android operating system, specifically components involved in parcel data handling, such as the Binder IPC mechanism.
The vulnerability enables local escalation of privilege with no additional execution privileges required beyond low-privilege user access (PR:L). Exploitation requires local access, low attack complexity (AC:L), and no user interaction (UI:N), potentially resulting in high impacts to confidentiality, integrity, and availability (CVSS:3.1 score of 7.8; C:H/I:H/A:H).
The Android Security Bulletin published on 2025-01-01 at https://source.android.com/security/bulletin/2025-01-01 details affected versions and provides patches for mitigation. Security practitioners should apply these updates promptly to vulnerable Android devices.
Details
- CWE(s)