CVE-2024-39430
📋 TL;DR
This vulnerability in the faceid service allows local attackers to cause denial of service through an out-of-bounds write. It affects Unisoc devices with vulnerable faceid implementations. No special privileges are required to exploit this flaw.
💻 Affected Systems
- Unisoc chipsets with faceid service
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash or kernel panic leading to device instability and persistent denial of service.
Likely Case
Local application crash affecting face recognition functionality, potentially requiring device restart.
If Mitigated
Limited impact with proper access controls and service isolation preventing unauthorized local access.
🎯 Exploit Status
Requires local access to device and knowledge of triggering the out-of-bounds write condition.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in advisory
Vendor Advisory: https://www.unisoc.com/en_us/secy/announcementDetail/1807576926177525762
Restart Required: Yes
Instructions:
1. Contact device manufacturer for firmware updates
2. Apply security patches from Unisoc
3. Reboot device after patch installation
🔧 Temporary Workarounds
Disable faceid service
androidTemporarily disable face recognition functionality to prevent exploitation
adb shell pm disable com.unisoc.faceid
adb shell pm disable-user --user 0 com.unisoc.faceid
Restrict local access
allImplement strict access controls to prevent unauthorized local access to devices
🧯 If You Can't Patch
- Implement device access controls to limit who can interact with the device locally
- Monitor for abnormal faceid service crashes or system instability
🔍 How to Verify
Check if Vulnerable:
Check device chipset manufacturer and faceid service version. Vulnerable if using Unisoc chipset with unpatched faceid service.Check Version:
adb shell dumpsys package com.unisoc.faceid | grep versionVerify Fix Applied:
Verify with manufacturer that latest firmware includes CVE-2024-39430 patch. Check faceid service version after update.📡 Detection & Monitoring
Log Indicators:
- Faceid service crashes
- Kernel panic logs
- Out-of-bounds memory access errors in system logs
Network Indicators:
- No network indicators - local vulnerability only
SIEM Query:
source="android_system" AND ("faceid" OR "com.unisoc.faceid") AND ("crash" OR "panic" OR "segmentation fault")