CVE-2024-29743
📋 TL;DR
CVE-2024-29743 is an out-of-bounds write vulnerability in the tmu_set_temp_lut function of tmu.c in Android's Pixel kernel. This allows local attackers to escalate privileges without user interaction or additional execution privileges. The vulnerability affects Google Pixel devices running vulnerable Android kernel versions.
💻 Affected Systems
- Google Pixel devices
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise with root privileges, enabling data theft, persistence, and lateral movement within the device.
Likely Case
Local privilege escalation allowing attackers to gain elevated permissions and bypass security controls.
If Mitigated
Limited impact with proper kernel hardening, SELinux policies, and timely patching.
🎯 Exploit Status
Exploitation requires local access but no user interaction. Kernel exploitation typically requires specific knowledge of memory layout.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: April 2024 Android security patch or later
Vendor Advisory: https://source.android.com/security/bulletin/pixel/2024-04-01
Restart Required: Yes
Instructions:
1. Check for system updates in Settings > System > System update. 2. Install the April 2024 or later security patch. 3. Reboot the device after installation.
🔧 Temporary Workarounds
Restrict app installations
androidOnly install apps from trusted sources like Google Play Store to reduce risk of malicious apps exploiting the vulnerability.
Enable Google Play Protect
androidEnsure Google Play Protect is enabled to detect potentially harmful apps.
🧯 If You Can't Patch
- Isolate affected devices from sensitive networks and data
- Implement strict app installation policies and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check Android security patch level in Settings > About phone > Android version. If before April 2024, device is vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify security patch level shows April 2024 or later in Settings > About phone > Android version.📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- SELinux denials for privilege escalation attempts
- Abnormal process behavior in system logs
Network Indicators:
- Unusual outbound connections from system processes
SIEM Query:
source="android_logs" AND (event_type="kernel_panic" OR process_name="tmu" OR privilege_escalation=true)