CVE-2024-29752
📋 TL;DR
This vulnerability allows local privilege escalation on affected Android devices through an out-of-bounds write in the tmu.c component. Attackers can exploit this without user interaction or additional execution privileges. Only Google Pixel devices running specific Android versions are affected.
💻 Affected Systems
- Google Pixel devices
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to gain root privileges, install persistent malware, access all user data, and bypass security controls.
Likely Case
Local attackers gaining elevated privileges to access sensitive data, install unauthorized applications, or modify system settings.
If Mitigated
Limited impact with proper patch management and device security policies in place, though still a serious local privilege escalation risk.
🎯 Exploit Status
Exploitation requires local access to the device but no user interaction. The vulnerability is in a kernel component, making exploitation more complex than user-space vulnerabilities.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: April 2024 Android security update
Vendor Advisory: https://source.android.com/security/bulletin/pixel/2024-04-01
Restart Required: Yes
Instructions:
1. Navigate to Settings > System > System update on Pixel device. 2. Check for and install the April 2024 security update. 3. Restart the device after installation completes.
🔧 Temporary Workarounds
No effective workarounds
allThis is a kernel-level vulnerability requiring patching. No configuration changes or workarounds are available.
🧯 If You Can't Patch
- Restrict physical access to devices and implement strict access controls
- Monitor for unusual privilege escalation attempts and suspicious system behavior
🔍 How to Verify
Check if Vulnerable:
Check Android security patch level in Settings > About phone > Android version. If patch level is earlier than April 5, 2024, the device is vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify the security patch level shows 'April 5, 2024' or later in Settings > About phone > Android version.📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- Unexpected privilege escalation attempts in system logs
- Abnormal tmu.c module behavior
Network Indicators:
- None - this is a local exploit
SIEM Query:
Search for kernel panic events or privilege escalation attempts on Android devices with security patch level before April 2024