CVE-2024-53835
Published: 03 January 2025
Summary
CVE-2024-53835 is a high-severity Incorrect Default Permissions (CWE-276) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-11 (Device Lock).
Deeper analysis
CVE-2024-53835 is a vulnerability affecting Android software on Google Pixel devices, enabling a possible biometric bypass due to an unusual root cause. This issue, associated with CWE-276, could lead to local escalation of privilege without requiring additional execution privileges or user interaction. It has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity for local attacks.
A local attacker with low privileges can exploit this vulnerability due to its low complexity and lack of need for user interaction. Successful exploitation allows the attacker to achieve high impacts on confidentiality, integrity, and availability, potentially granting elevated privileges on the affected device.
The Pixel security bulletin dated 2024-12-01 addresses this vulnerability with patches. Security practitioners should consult https://source.android.com/security/bulletin/pixel/2024-12-01 for mitigation details and apply the recommended updates to affected devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52162
Vulnerability details
there is a possible biometric bypass due to an unusual root cause. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local privilege escalation via biometric bypass exploitation on Android.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely remediation of identified flaws like CVE-2024-53835 via vendor patches in the Pixel security bulletin.
Enforces device lock with biometric mechanisms, addressing bypass risks by mandating automatic lockout and strong unlock requirements on mobile devices.
Manages biometric authenticators securely to prevent exploitation of bypass vulnerabilities through proper distribution, storage, and usage controls.