CVE-2024-23697
📋 TL;DR
This CVE describes a use-after-free vulnerability in the RGXCreateHWRTData_aux function of rgxta3d.c that allows arbitrary code execution. It enables local privilege escalation to kernel level without requiring additional execution privileges or user interaction. This affects Android devices with vulnerable GPU drivers.
💻 Affected Systems
- Android devices with PowerVR GPU drivers
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with kernel-level code execution, allowing attackers to bypass all security controls, install persistent malware, and access all user data.
Likely Case
Local privilege escalation from a compromised app to kernel privileges, enabling data theft, surveillance, and further system exploitation.
If Mitigated
Limited impact if devices are fully patched, have SELinux/AppArmor enforcing strict policies, and run with minimal privileges.
🎯 Exploit Status
Exploitation requires local access but no user interaction. Use-after-free vulnerabilities typically require precise timing and memory manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: June 2024 Android Security Patch or later
Vendor Advisory: https://source.android.com/security/bulletin/2024-06-01
Restart Required: Yes
Instructions:
1. Check for Android system updates in Settings > System > System update. 2. Install June 2024 security patch or later. 3. Reboot device after installation. 4. Verify patch level in Settings > About phone > Android version.
🔧 Temporary Workarounds
Restrict app installations
androidOnly install apps from trusted sources like Google Play Store with Play Protect enabled
Enable Google Play Protect
androidEnsure Google Play Protect is active to detect and block malicious apps
🧯 If You Can't Patch
- Isolate affected devices from sensitive networks and data
- Implement application allowlisting to prevent untrusted app execution
🔍 How to Verify
Check if Vulnerable:
Check Android security patch level in Settings > About phone > Android version. If patch level is before June 2024, device is vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify Android security patch level shows June 2024 or later in Settings > About phone > Android version.📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- SELinux/AVC denials related to GPU drivers
- Unexpected process privilege escalation
Network Indicators:
- Unusual outbound connections from system processes
SIEM Query:
Process: (parent_name: "system_server" OR parent_name: "zygote") AND (current_privileges: "root" OR current_privileges: "kernel")