CVE-2024-53833
Published: 03 January 2025
Summary
CVE-2024-53833 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 9.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2024-53833 is a vulnerability in the prepare_response_locked function of lwis_transaction.c that enables a possible out-of-bounds write due to improper input validation. It affects Google Pixel devices on Android, as documented in the December 2024 Pixel security bulletin.
The vulnerability allows local escalation of privilege with no additional execution privileges required and no user interaction needed. A local attacker with low privileges (PR:L) can exploit it under low attack complexity conditions (AC:L), potentially achieving high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), resulting in a CVSS v3.1 base score of 7.8 (CWE-787).
The Android Pixel security bulletin at https://source.android.com/security/bulletin/pixel/2024-12-01 provides details on patches for mitigation. Security practitioners should apply these updates to affected Pixel devices to address the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52160
Vulnerability details
In prepare_response_locked of lwis_transaction.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write with improper input validation directly provides a memory corruption primitive for local privilege escalation on Android (no user interaction or additional privileges required).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates input validation mechanisms to prevent the out-of-bounds write due to improper input validation in prepare_response_locked.
Implements memory safeguards that protect against unauthorized out-of-bounds writes enabling local privilege escalation.
Requires identification and correction of the specific buffer overflow flaw via timely patching as detailed in the Pixel security bulletin.