CVE-2024-32929
📋 TL;DR
This vulnerability is a use-after-free memory corruption flaw in the GPU SLC (System Level Cache) driver for Pixel devices. It allows local attackers to escalate privileges without user interaction, potentially gaining kernel-level access. Only Google Pixel devices with specific GPU drivers are affected.
💻 Affected Systems
- Google Pixel devices
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise with kernel-level privileges, allowing installation of persistent malware, data theft, and complete system control.
Likely Case
Local privilege escalation enabling unauthorized access to sensitive data and system resources.
If Mitigated
Limited impact if devices are fully patched and have security features like SELinux enforcing mode enabled.
🎯 Exploit Status
Requires local access but no user interaction. Memory corruption exploitation requires specific knowledge of GPU driver internals.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: May 2024 Android security patch level or later
Vendor Advisory: https://source.android.com/security/bulletin/pixel/2024-05-01
Restart Required: Yes
Instructions:
1. Check for system updates in Settings > System > System update. 2. Install May 2024 security patch. 3. Reboot device. 4. Verify patch level in Settings > About phone > Android version.
🔧 Temporary Workarounds
Restrict local access
allLimit physical and remote local access to vulnerable devices
🧯 If You Can't Patch
- Isolate vulnerable devices from sensitive networks and data
- Implement strict access controls and monitoring for local privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check Android security patch level in Settings > About phone > Android version. If patch level is earlier than May 2024, device is vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify Android security patch level shows May 2024 or later in Settings > About phone > Android version.📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- GPU driver crash reports
- SELinux denials related to GPU operations
Network Indicators:
- None - local exploit only
SIEM Query:
Device logs showing kernel crashes or privilege escalation attempts from GPU-related processes