CVE-2024-29740: Google Android Privilege Escalation Flaw

CVE-2024-29740 Overview

CVE-2024-29740 is an out-of-bounds write vulnerability in the tmu_set_table function of tmu.c in Google Android. The flaw stems from a missing bounds check that permits writing beyond the intended buffer boundary. Successful exploitation results in local privilege escalation without requiring additional execution privileges or user interaction. The vulnerability affects the Thermal Management Unit (TMU) code path in Pixel devices and is classified under [CWE-787] Out-of-Bounds Write.

Critical Impact
A local attacker can trigger memory corruption in the TMU subsystem to escalate privileges on affected Android devices without user interaction.

Affected Products

Google Android (Pixel devices)
Android builds shipping the vulnerable tmu.c component prior to the April 2024 security patch level
Devices tracked by the April 2024 Pixel Security Bulletin

Discovery Timeline

2024-04-05 - CVE-2024-29740 published to NVD
2024-04-01 - Fix included in the Android Pixel Security Bulletin for April 2024
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29740

Vulnerability Analysis

The vulnerability exists in the tmu_set_table function within tmu.c, a component of the Thermal Management Unit driver on Android. The function processes table data used to configure thermal control parameters. It fails to validate the length or index of the data before writing to a destination buffer, producing an out-of-bounds write condition.

An attacker with local access to an affected device can supply crafted input that drives the write past the allocated buffer boundary. Because the affected code runs in a privileged kernel or system context, corruption of adjacent memory structures can be leveraged to elevate privileges from an unprivileged process to a higher-privileged one.

Root Cause

The root cause is a missing bounds check in tmu_set_table prior to writing into a fixed-size buffer. Without validation of the input length or index against the destination buffer size, the function writes attacker-controlled data outside the intended memory region. This maps to [CWE-787] Out-of-Bounds Write.

Attack Vector

Exploitation requires local access to the target device. The attacker must be able to reach the vulnerable interface exposed by the TMU driver, typically through a compromised or malicious application running on the device. No user interaction is required. Attack complexity is high, reflecting the timing and memory layout conditions needed to convert the out-of-bounds write into reliable privilege escalation.

No public proof-of-concept exploit is currently available, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Android Security Bulletin April 2024 for component-level technical details.

Detection Methods for CVE-2024-29740

Indicators of Compromise

Unexpected crashes or kernel panics referencing the TMU driver or tmu.c in device logs
Applications requesting or interacting with thermal control interfaces without legitimate business purpose
Devices reporting a security patch level earlier than April 2024 on Pixel hardware

Detection Strategies

Inventory managed Android devices and flag those below the 2024-04-01 security patch level
Monitor mobile threat defense telemetry for anomalous process behavior tied to thermal or system-level APIs
Review installed applications for unsigned or sideloaded packages that access low-level device interfaces

Monitoring Recommendations

Collect and centralize Android device logs, including logcat and kernel messages, for retrospective analysis
Track patch-level compliance across the mobile fleet through mobile device management (MDM) reporting
Alert on repeated abnormal terminations of privileged system services on managed devices

How to Mitigate CVE-2024-29740

Immediate Actions Required

Update affected Pixel devices to the April 2024 security patch level or later
Enforce minimum Android security patch level policies through MDM for enrolled devices
Restrict installation of applications from untrusted sources on managed devices

Patch Information

Google addressed CVE-2024-29740 in the April 2024 Pixel Security Bulletin. Device owners and administrators should apply the security update dated 2024-04-05 or later. Full remediation details are documented in the Android Security Bulletin April 2024.

Workarounds

No official workaround is published; applying the vendor patch is the supported remediation
Limit exposure by preventing installation of untrusted applications on unpatched devices
Segregate unpatched devices from access to sensitive corporate resources until updates are applied

bash

# Verify Android security patch level on a connected device via adb
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2024-04-01 or later