9.8crit
CVE-2024-32905
In circ_read of link_device_memory_legacy.c, there is a possible out of bounds write due to an incorrect bounds check.
Published 2 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 26%
Public exploits
0
none known
Summary
In circ_read of link_device_memory_legacy.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction (EPSS)
0.33% probability of exploitation in the next 30 days, higher than 26% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Google Android
Classification
- Weakness
- CWE-787 Out-of-bounds Write
References
- source.android.com /security/bulletin/pixel/2024-06-01 · x_transferred
Sources
- CVE List: CVE-2024-32905
- NVD: CVE-2024-32905
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.