CVE-2024-31336: Google Android Privilege Escalation Flaw

CVE-2024-31336 Overview

CVE-2024-31336 is a local privilege escalation vulnerability in the Android kernel, specifically within the PVRSRVBridgeRGXKickTA3D2 function of server_rgxta3d_bridge.c. The flaw stems from improper input validation in the PowerVR GPU kernel driver bridge. A local attacker with low privileges can trigger arbitrary code execution in the kernel without user interaction. Google addressed the issue in the Android Security Bulletin dated September 2024. The vulnerability is categorized as an out-of-bounds write [CWE-787].

Critical Impact
Local escalation of privilege to kernel context with no user interaction required, allowing full compromise of the affected Android device.

Affected Products

Google Android (PowerVR GPU driver, server_rgxta3d_bridge.c)
Devices shipping the Imagination Technologies PowerVR kernel bridge component
Android builds without the September 2024 security patch level

Discovery Timeline

2024-09-11 - CVE-2024-31336 published to NVD
2024-09-01 - Google publishes fix in the Android Security Bulletin (September 2024)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-31336

Vulnerability Analysis

The vulnerability resides in the PVRSRVBridgeRGXKickTA3D2 bridge handler, which processes user-space requests to submit 3D rendering workloads to the PowerVR GPU. The handler fails to properly validate input parameters received from user space before using them in kernel memory operations. This deficiency permits an out-of-bounds write [CWE-787] within kernel memory.

Because the bridge executes with kernel privileges, corruption of adjacent kernel structures allows an attacker to hijack control flow. The result is arbitrary code execution in kernel context. No additional execution privileges are required beyond the ability to open the PowerVR device node, which is typically available to standard Android applications.

Root Cause

The root cause is improper input validation in PVRSRVBridgeRGXKickTA3D2. Attacker-controlled fields, such as array counts and buffer sizes accompanying a TA3D (Tile Accelerator / 3D) kick request, are not adequately bounds-checked before being used in kernel copy operations. This mismatch between declared and actual sizes drives the out-of-bounds write.

Attack Vector

An unprivileged local application invokes the PowerVR ioctl bridge and issues a crafted RGXKickTA3D2 request containing malformed length or index parameters. The kernel writes attacker-controlled data past the bounds of the intended buffer, corrupting kernel structures. See the Android Security Bulletin September 2024 for component-level technical details.

No verified public proof-of-concept is available at the time of writing. The vulnerability is not listed on CISA KEV, and no in-the-wild exploitation has been confirmed.

Detection Methods for CVE-2024-31336

Indicators of Compromise

Unexpected kernel oops or panic logs referencing PVRSRVBridgeRGXKickTA3D2 or pvrsrvkm in dmesg or logcat.
Untrusted or newly installed applications opening /dev/pvr_sync or the PowerVR services device node without a legitimate rendering use case.
Anomalous SELinux denials involving GPU bridge access from non-graphics processes.

Detection Strategies

Monitor Android device logs for repeated crashes in the PowerVR kernel module, which may indicate exploitation attempts.
Baseline application behavior for access to GPU driver device nodes and alert on outliers.
Correlate kernel crash telemetry with process installation events to surface suspicious sequences.

Monitoring Recommendations

Enforce reporting of Android security patch level through mobile device management (MDM) and flag devices below September 2024.
Ingest Android kernel and system logs into a central SIEM for kernel-fault pattern analysis.
Track application inventory changes on managed devices to identify apps requesting unusual GPU driver interactions.

How to Mitigate CVE-2024-31336

Immediate Actions Required

Update affected Android devices to a build with security patch level 2024-09-01 or later.
Identify unpatched devices through MDM and prioritize remediation for those handling sensitive data.
Restrict installation of untrusted applications, particularly those requesting broad hardware access.

Patch Information

Google released fixes in the September 2024 Android Security Bulletin. Devices reporting a security patch level of 2024-09-05 or later include the corrected PVRSRVBridgeRGXKickTA3D2 input validation. Refer to the Android Security Bulletin September 2024 for OEM guidance and per-device availability.

Workarounds

No official workaround exists; patching is the only supported remediation.
Limit device exposure by prohibiting sideloading and enforcing Google Play Protect on managed fleets.
Retire or isolate devices that no longer receive vendor security updates covering September 2024.

bash

# Verify Android security patch level on a device via ADB
adb shell getprop ro.build.version.security_patch
# Expected output for remediation: 2024-09-01 or later