CVE-2024-49738
Published: 21 January 2025
Description
In writeInplace of Parcel.cpp, there is a possible out of bounds write. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Security Summary
CVE-2024-49738 is a vulnerability involving a possible out-of-bounds write in the writeInplace function of Parcel.cpp. This issue affects the Android operating system, specifically the Parcel component used for inter-process communication. Assigned CWE-787, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-01-21.
The vulnerability enables local escalation of privilege without requiring additional execution privileges or user interaction. An attacker with low-privilege local access (PR:L) can exploit it due to low attack complexity (AC:L), potentially achieving high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) by overwriting memory beyond intended bounds.
The Android security bulletin at https://source.android.com/security/bulletin/2025-01-01 provides details on affected versions and patches for mitigation.
Details
- CWE(s)