Google fixed actively exploited Android flaw CVE-2024-32896

Google addressed a security vulnerability in its Android operating system that is actively exploited in attacks in the wild.

Google addressed a high-severity vulnerability, tracked as CVE-2024-32896 (CVSS score: 7.8), in its Android operating system that is under active exploitation in the wild.

The vulnerability CVE-2024-32896 is a privilege escalation in the Android Framework component.

“there is a possible way to bypass due to a logic error in the code.” reads the advisory published by NIST National Vulnerability Database (NVD). “This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.”

Google addressed the issue with the release of the Android Security Bulletin for September 2024.

“There are indications that CVE-2024-32896 may be under limited, targeted exploitation.” reads the Bulletin for September 2024.

In June 2024, Google warned of an elevation of privilege vulnerability, tracked as CVE-2024-32896, in the Pixel Firmware, which has been exploited in the wild as a zero-day.

“There are indications that CVE-2024-32896 may be under limited, targeted exploitation.” reads the advisory.

As usual, the IT giant did not provide technical information about attacks exploiting the above issue.

The maintainers of GrapheneOS, an Android-based, open source, privacy and security-focused mobile operating system, explained that CVE-2024-32896 results from the partial mitigation of another flaw tracked as CVE-2024-29748.

The experts pointed out that while these vulnerabilities are not exclusive to Pixel devices, the mitigations only addressed the issues on Pixels. The vulnerabilities involve interrupting reboots for wipes via the device admin API, applicable to all devices. CVE-2024-32896 is a full fix included in Android 14 QPR3, while CVE-2024-29748 was a Pixel-specific mitigation in the bootloader. The full solution now allows wipe-without-reboot in Android 14 QPR3.

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(Security Affairs – hacking, CVE-2024-32896)