CVE-2024-56192
Published: 10 March 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2024-56192 is a vulnerability involving an out-of-bounds write due to a missing bounds check in the wl_notify_gscan_event function of wl_cfgscan.c. This flaw affects the Pixel Watch, as documented in the associated Android security bulletin.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity (AC:L) and no user interaction required (UI:N). Exploitation enables local escalation of privilege, potentially compromising high levels of confidentiality, integrity, and availability (C:H/I:H/A:H), as reflected in its CVSS v3.1 base score of 7.8.
The Android security bulletin for Pixel Watch, dated 2025-03-01 and available at https://source.android.com/docs/security/bulletin/pixel-watch/2025/2025-03-01, provides details on patches to mitigate this issue. Security practitioners should ensure affected devices receive these updates to prevent exploitation.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Out-of-bounds write in wl_notify_gscan_event enables local privilege escalation from low-privileged context with no user interaction.