CVE-2024-49745
Published: 21 January 2025
Description
In growData of Parcel.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Security Summary
CVE-2024-49745 is a vulnerability in the growData function of Parcel.cpp, where an incorrect bounds check can lead to an out-of-bounds write (CWE-787). This issue affects the Android operating system, specifically components involved in parcel data handling, such as the Binder IPC mechanism.
The vulnerability enables local escalation of privilege with no additional execution privileges required beyond low-privilege user access (PR:L). Exploitation requires local access, low attack complexity (AC:L), and no user interaction (UI:N), potentially resulting in high impacts to confidentiality, integrity, and availability (CVSS:3.1 score of 7.8; C:H/I:H/A:H).
The Android Security Bulletin published on 2025-01-01 at https://source.android.com/security/bulletin/2025-01-01 details affected versions and provides patches for mitigation. Security practitioners should apply these updates promptly to vulnerable Android devices.
Details
- CWE(s)