CVE-2024-32927
📋 TL;DR
This CVE describes a use-after-free vulnerability in Android's RadioExt component that allows local privilege escalation without user interaction. Attackers can exploit improper locking in sendDeviceState_1_6 to execute arbitrary code with elevated privileges. This affects Android devices, particularly Google Pixel phones.
💻 Affected Systems
- Google Pixel phones
- Android devices with Qualcomm radio components
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to gain root/system-level access, install persistent malware, access all user data, and bypass security controls.
Likely Case
Local privilege escalation allowing attackers to bypass app sandboxing, access sensitive system resources, and potentially install malicious apps with elevated permissions.
If Mitigated
Limited impact if devices are fully patched, have SELinux enforcing mode, and run with minimal privileges.
🎯 Exploit Status
Exploitation requires local access but no user interaction. The use-after-free condition requires precise timing to exploit successfully.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: August 2024 Android security patch level or later
Vendor Advisory: https://source.android.com/security/bulletin/pixel/2024-08-01
Restart Required: Yes
Instructions:
1. Check for system updates in Settings > System > System update. 2. Install the August 2024 security patch. 3. Reboot the device. 4. Verify patch level in Settings > About phone > Android version.
🔧 Temporary Workarounds
Disable unnecessary radio services
androidReduce attack surface by disabling non-essential radio services if device functionality permits
🧯 If You Can't Patch
- Isolate affected devices from sensitive networks and data
- Implement strict app installation policies and monitor for suspicious privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check Android security patch level in Settings > About phone. If before August 2024, device is vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify security patch level shows 'August 5, 2024' or later in Settings > About phone > Android version.📡 Detection & Monitoring
Log Indicators:
- Unusual privilege escalation attempts in system logs
- Radio service crashes or abnormal behavior
SIEM Query:
Look for process privilege changes from radio-related services or unexpected root access attempts