CVE-2024-32896

Description

there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

References

https://www.bleepingcomputer.com/news/security/google-backports-fix-for-pixel-eop-flaw-to-other-android-devices/

https://thehackernews.com/2024/09/google-confirms-cve-2024-32896.html

https://securityaffairs.com/168047/mobile-2/google-fixed-actively-exploited-android-flaw-cve-2024-32896.html

https://thehackernews.com/2024/08/google-patches-new-android-kernel.html

https://www.bleepingcomputer.com/news/security/google-fixes-android-kernel-zero-day-exploited-in-targeted-attacks/

https://www.securityweek.com/google-warns-of-pixel-firmware-zero-day-under-limited-targeted-exploitation/

https://source.android.com/security/bulletin/pixel/2024-06-01

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3