CVE-2024-53840
Published: 03 January 2025
Summary
CVE-2024-53840 is a high-severity Incorrect Default Permissions (CWE-276) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2024-53840 is a biometric bypass vulnerability stemming from an unusual root cause, enabling local escalation of privilege without requiring additional execution privileges or user interaction. It affects Google Pixel devices, as detailed in the Android security bulletin, and has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with an associated CWE-276.
A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of need for user interaction. Successful exploitation allows the attacker to gain high-impact access across confidentiality, integrity, and availability, effectively escalating privileges on the affected Pixel device.
The official mitigation is outlined in the Android Security Bulletin for Pixel devices dated 2024-12-01, available at https://source.android.com/security/bulletin/pixel/2024-12-01, which includes patches to address the issue. Security practitioners should ensure Pixel devices are updated to the patched firmware versions specified in the bulletin.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52167
Vulnerability details
there is a possible biometric bypass due to an unusual root cause. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local biometric bypass directly enables exploitation for privilege escalation (T1068) on affected devices.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Remediating the biometric bypass flaw in CVE-2024-53840 via timely patching directly prevents local privilege escalation on affected Pixel devices.
Enforcing approved authorizations for access control directly counters privilege escalation enabled by the biometric bypass.
Least privilege limits the impact and scope of exploitation by low-privileged local attackers using the biometric bypass vulnerability.