CVE-2025-36900
📋 TL;DR
This CVE describes an integer overflow vulnerability in the lwis_test_register_io function of lwis_device_test.c that leads to an out-of-bounds write. It allows local privilege escalation to SYSTEM level without user interaction. This affects Android devices, particularly Google Pixel phones.
💻 Affected Systems
- Google Pixel phones
- Android devices using affected lwis components
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
An attacker with local access could gain SYSTEM privileges, potentially compromising the entire device, accessing sensitive data, or installing persistent malware.
Likely Case
Local privilege escalation allowing an attacker to bypass security controls and execute arbitrary code with elevated permissions.
If Mitigated
With proper patching and security controls, the risk is reduced to minimal as exploitation requires local access and specific conditions.
🎯 Exploit Status
Exploitation requires local access and understanding of the integer overflow condition to trigger the OOB write.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android September 2025 security patch
Vendor Advisory: https://source.android.com/security/bulletin/pixel/2025-09-01
Restart Required: No
Instructions:
1. Apply the September 2025 Android security patch. 2. For Pixel devices, check for OTA updates in Settings > System > System update. 3. For other Android devices, check with your manufacturer for security updates.
🔧 Temporary Workarounds
Restrict local access
allLimit physical and remote local access to devices to reduce attack surface
🧯 If You Can't Patch
- Implement strict access controls to limit who has local access to devices
- Monitor for suspicious privilege escalation attempts and unusual system behavior
🔍 How to Verify
Check if Vulnerable:
Check Android security patch level in Settings > About phone > Android version. If patch level is earlier than September 2025, device is vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify Android security patch level shows September 2025 or later in Settings > About phone > Android version.📡 Detection & Monitoring
Log Indicators:
- Unusual privilege escalation attempts
- Suspicious access to lwis_device_test.c functions
- Crash reports involving lwis components
Network Indicators:
- Not applicable - local vulnerability
SIEM Query:
Search for events related to privilege escalation, process creation with elevated privileges, or crashes in lwis-related components