cyfenced.com →

[ CVE-2024-29745 · Published 5 Apr 2024 ]

Android Pixel Information Disclosure Vulnerability

Exploited · CISA KEV CVSS 5.5 EPSS <1%No fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2024-04-04

[ Description ]Official description

there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CISA: Android Pixel contains an information disclosure vulnerability in the fastboot firmware used to support unlocking, flashing, and locking affected devices.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 25 Apr 2024): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References