CVE-2024-34732
Published: 28 January 2025
Description
In RGXMMUCacheInvalidate of rgxmem.c, there is a possible arbitrary code execution due to a race condition. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
Security Summary
CVE-2024-34732 is a race condition vulnerability in the RGXMMUCacheInvalidate function of rgxmem.c, a component of the Android kernel associated with the PowerVR (RGX) GPU driver. This flaw allows for arbitrary code execution and has a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), mapped to CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization).
A local attacker requires no special privileges or user interaction to exploit this vulnerability due to its low attack complexity. Successful exploitation enables escalation of privilege within the kernel, potentially granting full control over the affected device with high impacts on confidentiality, integrity, and availability.
The Android Security Bulletin published on October 1, 2024, addresses this issue with patches available at https://source.android.com/security/bulletin/2024-10-01. Security practitioners should ensure devices receive these updates to mitigate the risk.
Details
- CWE(s)