CVE-2025-36908
📋 TL;DR
This vulnerability allows local privilege escalation on affected Android devices through an out-of-bounds write in the lwis_device_top.c component. Attackers with system execution privileges can exploit this without user interaction to gain elevated access. Primarily affects Google Pixel devices running vulnerable Android versions.
💻 Affected Systems
- Google Pixel devices
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to execute arbitrary code with kernel privileges, bypass security controls, and access sensitive data.
Likely Case
Local privilege escalation enabling attackers to gain persistent root access, install malware, or bypass application sandboxing.
If Mitigated
Limited impact if devices are fully patched and have security controls like SELinux enforcing mode enabled.
🎯 Exploit Status
Exploitation requires system execution privileges and knowledge of memory layout. No public exploit code available as of analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: September 2025 Android security patch or later
Vendor Advisory: https://source.android.com/security/bulletin/pixel/2025-09-01
Restart Required: No
Instructions:
1. Check for system updates in Settings > System > System update. 2. Install September 2025 security patch or later. 3. Verify patch installation through Settings > About phone > Android version.
🔧 Temporary Workarounds
Restrict app installations
AndroidPrevent installation of untrusted applications that could obtain system privileges
adb shell settings put secure install_non_market_apps 0
🧯 If You Can't Patch
- Implement strict application allowlisting to prevent malicious apps from obtaining system privileges
- Enable Google Play Protect and ensure all apps are from trusted sources only
🔍 How to Verify
Check if Vulnerable:
Check Android security patch level in Settings > About phone > Android version. If before September 2025, device is vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify Android security patch level shows September 2025 or later in Settings > About phone > Android version.📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- SELinux denials related to lwis_device_top
- Unexpected privilege escalation attempts
Network Indicators:
- None - local exploitation only
SIEM Query:
source="android_logs" AND ("lwis_device_top" OR "kernel panic" OR "out of bounds")