CVE-2024-53841
Published: 03 January 2025
Summary
CVE-2024-53841 is a high-severity Incorrect Default Permissions (CWE-276) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2024-53841 is a permission bypass vulnerability stemming from a confused deputy issue in the startListeningForDeviceStateChanges function. It affects Google Pixel devices running Android, as documented in the December 2024 Pixel security bulletin. The flaw enables local escalation of privilege without requiring additional execution privileges or user interaction and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), mapped to CWE-276.
A local attacker with low privileges (PR:L) can exploit this vulnerability due to its low attack complexity (AC:L) and lack of need for user interaction (UI:N). Successful exploitation allows the attacker to achieve high impacts on confidentiality, integrity, and availability, facilitating privilege escalation on the affected device.
The Android Pixel security bulletin at https://source.android.com/security/bulletin/pixel/2024-12-01 provides details on patches and mitigation for this vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52168
Vulnerability details
In startListeningForDeviceStateChanges, there is a possible Permission Bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local privilege escalation via confused deputy/permission bypass vulnerability directly matches Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Reference monitor enforces tamper-proof mediation of all accesses, directly preventing confused deputy permission bypass in startListeningForDeviceStateChanges.
Access enforcement ensures approved authorizations are applied, blocking the local privilege escalation from improper permission checks.
Least privilege restricts processes to minimal necessary rights, limiting the scope and impact of escalation even if a bypass occurs.