CVE-2024-53838
Published: 03 January 2025
Summary
CVE-2024-53838 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 12.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-53838 involves an out-of-bounds write vulnerability stemming from an incorrect bounds check in the Exynos_parsing_user_data_registered_itu_t_t35 function of VendorVideoAPI.cpp. This flaw affects Android devices, as detailed in the Pixel security bulletin, and is classified under CWE-787 with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges, such as a standard user or app, can exploit this vulnerability to escalate privileges without needing additional execution privileges or user interaction. The low attack complexity enables arbitrary code execution or system compromise, leading to high impacts on confidentiality, integrity, and availability.
The Android Pixel security bulletin dated 2024-12-01, available at https://source.android.com/security/bulletin/pixel/2024-12-01, documents patches addressing this CVE for affected devices. Security practitioners should apply these updates promptly to mitigate the risk.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52165
Vulnerability details
In Exynos_parsing_user_data_registered_itu_t_t35 of VendorVideoAPI.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write enables local privilege escalation via arbitrary code execution on Android (maps directly to Exploitation for Privilege Escalation).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, reporting, and correction of the out-of-bounds write vulnerability through patching as provided in the Android Pixel security bulletin.
Implements memory protection mechanisms such as address space layout randomization and data execution prevention to mitigate exploitation of the out-of-bounds write in VendorVideoAPI.
Enforces input validation and bounds checking for user data parsed by Exynos_parsing_user_data_registered_itu_t_t35 to prevent the incorrect bounds check leading to privilege escalation.