CVE-2024-47018
📋 TL;DR
This vulnerability allows local attackers to read memory beyond intended buffer boundaries in Android's power management unit calibration code. It affects Android devices, particularly Google Pixel phones, and could disclose sensitive system information without requiring user interaction or elevated privileges.
💻 Affected Systems
- Google Pixel phones
- Android devices using Qualcomm PMIC
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
An attacker could read sensitive kernel memory containing cryptographic keys, passwords, or other protected data, potentially enabling further system compromise.
Likely Case
Local information disclosure of system memory contents, which could reveal device-specific information useful for other attacks.
If Mitigated
With proper kernel hardening and memory protection mechanisms, impact is limited to reading non-sensitive memory regions.
🎯 Exploit Status
Requires local access and knowledge of kernel memory layout. No authentication needed but requires ability to trigger the vulnerable function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: October 2024 Android security patch
Vendor Advisory: https://source.android.com/security/bulletin/pixel/2024-10-01
Restart Required: Yes
Instructions:
1. Check for system updates in Settings > System > System update. 2. Install October 2024 Android security patch. 3. Reboot device after installation completes.
🔧 Temporary Workarounds
Disable vulnerable driver module
linuxPrevent loading of the vulnerable flexpmu_cal_rae driver module
echo 'blacklist flexpmu_cal_rae' >> /etc/modprobe.d/blacklist.conf
rmmod flexpmu_cal_rae
🧯 If You Can't Patch
- Restrict local access to devices through physical security controls
- Implement application sandboxing and SELinux policies to limit impact
🔍 How to Verify
Check if Vulnerable:
Check Android security patch level in Settings > About phone > Android version. If before October 2024, device is vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify Android security patch level shows 'October 5, 2024' or later in Settings > About phone > Android version.📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- Unexpected memory access errors in dmesg
- SELinux denials related to pmucal operations
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
source="android_kernel" AND ("pmucal" OR "flexpmu") AND ("out of bounds" OR "buffer overflow")