CVE-2024-32929: Google Android Privilege Escalation Flaw

CVE-2024-32929 Overview

CVE-2024-32929 is a use-after-free vulnerability in the gpu_slc_get_region function within pixel_gpu_slc.c, a component of the Pixel GPU driver in Google Android. The flaw allows a local attacker to achieve elevation of privilege (EoP) without requiring additional execution privileges or user interaction. The vulnerability is tracked under CWE-416: Use After Free and was addressed in the Android Security Bulletin May 2024.

Critical Impact
Successful exploitation enables local privilege escalation on affected Pixel devices, potentially granting kernel-level access to attacker-controlled code.

Affected Products

Google Android (Pixel devices)
Pixel GPU driver containing pixel_gpu_slc.c
Devices not patched against the May 2024 Pixel Security Bulletin

Discovery Timeline

2024-06-13 - CVE-2024-32929 published to NVD
2024-05-01 - Google releases fix in Pixel Security Bulletin
2025-07-22 - Last updated in NVD database

Technical Details for CVE-2024-32929

Vulnerability Analysis

The vulnerability resides in the gpu_slc_get_region function of pixel_gpu_slc.c, part of the Pixel GPU System Level Cache (SLC) management code. The function mishandles the lifecycle of a memory region object, accessing it after it has been freed. An attacker with local code execution can trigger the dangling reference to corrupt kernel memory.

Use-after-free conditions in GPU driver code are particularly impactful because the GPU driver runs in kernel context. Successful exploitation can be leveraged to overwrite kernel data structures, hijack control flow, or escalate to root-equivalent privileges. The flaw requires no user interaction, allowing exploitation from any process able to interact with the GPU driver.

Root Cause

The root cause is improper object lifetime management within gpu_slc_get_region. The function retains or returns a reference to an SLC region structure after the underlying allocation has been released. Subsequent operations dereference this stale pointer, leading to memory corruption.

Attack Vector

Exploitation requires local access to the device with the ability to issue ioctl calls or otherwise interact with the Pixel GPU device node. A malicious application installed on the device can race region allocation and release operations to trigger the dangling reference. Once the freed memory is reclaimed with attacker-controlled data, the subsequent dereference yields kernel-mode primitives suitable for privilege escalation.

No verified public proof-of-concept exploit code is available for this vulnerability. Refer to the Android Security Bulletin May 2024 for technical details.

Detection Methods for CVE-2024-32929

Indicators of Compromise

Unexpected kernel panics or GPU driver crashes referencing pixel_gpu_slc or gpu_slc_get_region in dmesg or tombstone logs
Installation of untrusted applications followed by sudden privilege elevation events
Anomalous ioctl traffic targeting the Pixel GPU device node from non-graphics applications

Detection Strategies

Monitor Android device security patch level and flag devices missing the May 2024 Pixel patch
Review mobile threat defense telemetry for applications attempting to access GPU ioctl interfaces outside expected use cases
Correlate process crash reports with GPU driver stack traces to identify potential exploitation attempts

Monitoring Recommendations

Enforce mobile device management (MDM) policies that report device patch level and block enrollment of devices below the May 2024 baseline
Aggregate Android system logs centrally and alert on repeated GPU driver faults
Track installation of sideloaded APKs and unusual permission requests that precede kernel-level anomalies

How to Mitigate CVE-2024-32929

Immediate Actions Required

Apply the May 2024 Pixel security patch (security patch level 2024-05-05 or later) to all affected devices
Restrict installation of untrusted applications and enforce Google Play Protect on managed devices
Audit fleet inventory for Pixel devices running unpatched firmware and prioritize remediation

Patch Information

Google addressed CVE-2024-32929 in the Pixel Security Bulletin May 2024. Devices must be updated to the corresponding Pixel firmware release to receive the fix. Users should verify the security patch level under Settings → About phone → Android version.

Workarounds

No vendor-supplied workaround exists; patching is the only supported remediation
Limit installation of third-party applications to reduce the local attack surface until patches are applied
Use MDM controls to restrict device usage to trusted application catalogs on unpatched hardware

bash

# Verify Android security patch level on a Pixel device via ADB
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2024-05-05 or later