Vulnerability details
CVE-2024-34748
Google Android
CVSS 3.1
8.4High
Official description
In _DevmemXReservationPageAddress of devicemem_server.c, there is a possible use-after-free due to improper casting. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.4High | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Android | Android SoC | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-01-28
- Last updated
- 2025-01-29
- State
- Published
- Assigner (CNA)
- google_android
Exploit prediction (EPSS)
0.08%
Probability of exploitation in 30 days
0.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-416Use After Free