Android Phones Hit by Actively Exploited Elevation of Privilege Flaw

A critical vulnerability tracked as CVE-2024-32896, is currently being actively exploited in the wild, according to Google’s June 2024 Pixel Update Bulletin for Android.

This flaw, affecting Pixel devices, is related to the broader Android security landscape, underscoring the need for immediate updates by all device vendors.

Discovery and details

The vulnerability was initially identified and reported by the GrapheneOS team, who had previously detailed related issues in April 2024. Their analysis pointed out that the flaw was not Pixel-specific but applicable to a wide range of devices. The initial fix, CVE-2024-29748, was only a partial mitigation, addressing the ability to interrupt a factory reset triggered by a device admin app.

The CVE-2024-32896 vulnerability involves an elevation of privilege (EoP) within the Pixel firmware, allowing malicious actors to bypass standard security protocols. Google highlighted this issue in the June 2024 security patches, with a specific note on its active exploitation.

GrapheneOS provided a comprehensive breakdown of the flaw, explaining that the vulnerability allows attackers to interrupt the reboot process during a wipe via the device admin API. Forensic companies have utilized this exploitation method, raising significant concerns about the security of device data during resets.

CVE-2024-32896 which is marked as being actively exploited in the wild in the June 2024 Pixel Update Bulletin is the 2nd part of the fix for CVE-2024-29748 vulnerability we described here:https://t.co/c4xnnbje04

As we explained there, none of this is actually Pixel specific.

— GrapheneOS (@GrapheneOS) June 13, 2024

Patch and mitigation

Google’s June 2024 update includes a complete fix for CVE-2024-32896, integrating a robust solution within Android 14 QPR3 (Quarterly Platform Release 3). This update ensures that the wipe-without-reboot feature is now a standard part of the Android operating system, thereby preventing similar exploitation in the future. The security patch level 2024-06-05 or later includes these updates, which are critical for all users to install immediately.

GrapheneOS, a security and privacy-focused mobile operating system, has backported this feature to its releases, further enhancing the robustness of the wipe process. Their efforts to make this solution more redundant highlight the importance of addressing such vulnerabilities comprehensively.

Google-manufactured Pixel devices have been among the first to receive these critical updates. The Pixel series, known for its advanced security features and timely updates, now benefits from enhanced protections against this exploit. However, it’s essential to note that this vulnerability affects a broader range of Android devices, necessitating similar patches across the ecosystem.

Android device users should take the following steps to protect themselves from active exploitation:

• Ensure your device is updated to the security patch level 2024-06-05 or later.
• Verify the security patch level through the device settings to confirm the update has been applied.
• Regularly update your device, avoid installing untrusted applications, and use strong, unique passwords.

If you’re using an old and unsupported Android device, consider upgrading to a newer model or installing a third-party Android distribution that incorporates the latest security updates on builds for older device models.