CVE-2024-53842
Published: 03 January 2025
Summary
CVE-2024-53842 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Google Android. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 13.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of information inputs including bounds checks to prevent out-of-bounds writes like the missing check in cc_SendCcImsInfoIndMsg.
Implements memory protections such as non-executable memory and address randomization to mitigate remote code execution from out-of-bounds writes.
Mandates identification, reporting, and correction of flaws like this out-of-bounds write vulnerability through timely patching as provided in the Android bulletin.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write enables unauthenticated remote code execution over the network (AV:N, PR:N, UI:N), directly mapping to exploitation of remote/public-facing services or client software for initial execution on the device.
NVD Description
In cc_SendCcImsInfoIndMsg of cc_MmConManagement.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Deeper analysisAI
CVE-2024-53842 is a vulnerability involving an out-of-bounds write due to a missing bounds check in the cc_SendCcImsInfoIndMsg function of cc_MmConManagement.c. This issue affects Android devices, as documented in the Pixel security bulletin.
The vulnerability enables remote code execution without requiring additional execution privileges or user interaction. Per the CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), an attacker can exploit it over the network with low attack complexity and no privileges, achieving high impacts on confidentiality, integrity, and availability.
The Android Pixel security bulletin at https://source.android.com/security/bulletin/pixel/2024-12-01 provides details on patches to mitigate this vulnerability, associated with CWE-787.
Details
- CWE(s)