CVE-2024-32927 Overview
CVE-2024-32927 is a use-after-free vulnerability in the sendDeviceState_1_6 function of RadioExt.cpp in Google Android. The flaw stems from improper locking when accessing freed memory. A local attacker holding low-level privileges can exploit the issue to escalate privileges without user interaction. The vulnerability affects Google Pixel devices and was addressed in the August 2024 Pixel Security Bulletin. The weakness is classified under [CWE-416] (Use After Free).
Critical Impact
Local privilege escalation on affected Android Pixel devices without requiring user interaction or additional execution privileges.
Affected Products
- Google Android (Pixel devices)
- Android RadioExt component (RadioExt.cpp)
- Devices receiving updates prior to the 2024-08-01 Pixel security patch level
Discovery Timeline
- 2024-08-19 - CVE-2024-32927 published to the National Vulnerability Database
- 2024-08-20 - Last updated in NVD database
- August 2024 - Google releases security patch in the Pixel Security Bulletin
Technical Details for CVE-2024-32927
Vulnerability Analysis
The vulnerability resides in the sendDeviceState_1_6 function within RadioExt.cpp, a component of the Android Radio Interface Layer extension on Pixel devices. The function fails to apply proper locking when accessing shared memory structures. This creates a window where one execution path frees an object while another path still references it.
When the dangling pointer is dereferenced, the freed memory may already contain attacker-controlled data. This enables manipulation of program control flow and corruption of internal state. Successful exploitation grants the attacker elevated privileges within the Android system context.
Root Cause
The root cause is improper synchronization between threads or execution contexts that access shared resources in RadioExt.cpp. Without adequate locking, a race condition allows memory to be freed while a concurrent operation retains a pointer to it. This is a classic use-after-free pattern documented under [CWE-416].
Attack Vector
Exploitation requires local access to the device with low-privilege code execution, such as a malicious application installed by the user. No user interaction is required during the exploitation phase itself. The attacker triggers the race condition in sendDeviceState_1_6 to corrupt freed memory and pivot to higher privileges within the radio or system service context.
No public proof-of-concept code or active exploitation has been reported. Refer to the Android Security Bulletin August 2024 for technical references.
Detection Methods for CVE-2024-32927
Indicators of Compromise
- Unexpected crashes or tombstone files referencing the RadioExt or vendor.qti.hardware.radio processes
- Anomalous privilege transitions originating from radio-related system services
- Installed third-party applications invoking radio extension interfaces outside expected usage patterns
Detection Strategies
- Monitor logcat and dropbox output for repeated native crashes in the radio HAL process
- Inspect installed application manifests and runtime behavior for unusual access to telephony or radio interfaces
- Track devices reporting a security patch level earlier than 2024-08-01
Monitoring Recommendations
- Enforce minimum security patch level requirements through mobile device management (MDM) policies
- Aggregate Android device telemetry into a centralized log platform to identify crash signatures consistent with use-after-free conditions
- Audit application install sources and restrict sideloading on managed Pixel fleets
How to Mitigate CVE-2024-32927
Immediate Actions Required
- Apply the August 2024 Pixel security update (patch level 2024-08-01 or later) to all affected devices
- Inventory Pixel devices in the enterprise fleet and identify those running outdated builds
- Restrict installation of untrusted applications until patching is complete
Patch Information
Google addressed CVE-2024-32927 in the Android Security Bulletin August 2024 for Pixel devices. Device owners should install the latest over-the-air (OTA) update. Enterprise administrators should validate that managed devices report a security patch level of 2024-08-01 or later.
Workarounds
- Limit device exposure by removing untrusted applications and disabling sideloading
- Use MDM policies to block installation of unknown applications on managed Pixel devices
- Where patching is delayed, restrict device use to trusted application sources only
# Verify Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2024-08-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
