CVE-2024-29748

high

Description

there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

References

https://thehackernews.com/2025/04/google-reports-75-zero-days-exploited.html

https://www.bleepingcomputer.com/news/security/serbian-police-used-cellebrite-zero-day-hack-to-unlock-android-phones/

https://thehackernews.com/2024/09/google-confirms-cve-2024-32896.html

https://thehackernews.com/2024/08/google-patches-new-android-kernel.html

https://www.bleepingcomputer.com/news/security/google-fixes-android-kernel-zero-day-exploited-in-targeted-attacks/

https://www.bleepingcomputer.com/news/security/google-fixes-two-pixel-zero-day-flaws-exploited-by-forensics-firms/

https://securityaffairs.com/168047/mobile-2/google-fixed-actively-exploited-android-flaw-cve-2024-32896.html

https://source.android.com/security/bulletin/pixel/2024-04-01

Details

Source: Mitre, NVD

Published: 2024-04-05

Updated: 2024-11-29

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 7.2

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 7.8

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H