Use-After-Free Vulnerability in Device Memory Management of Android by Google

CVE-2024-34748

What is CVE-2024-34748?

A vulnerability has been identified in the device memory management component of Android, specifically within the 'DevmemXReservationPageAddress' function of 'devicemem_server.c'. This flaw arises from improper casting, leading to a potential use-after-free condition that allows local escalation of privilege within the kernel environment. The exploitation of this vulnerability does not require any additional execution privileges or user interaction, posing significant security risks for affected devices.

References