CVE-2024-34731 Overview
CVE-2024-34731 is a memory corruption vulnerability in Android caused by a race condition across multiple functions in TranscodingResourcePolicy.cpp. The flaw resides in the Android media framework and affects Android versions 12, 12L, 13, and 14. A local attacker with low privileges can exploit the race window to corrupt memory and escalate privileges on the device. Exploitation requires no user interaction and no additional execution privileges. Google addressed the issue in the Android Security Bulletin dated August 1, 2024. The vulnerability is tracked under CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) and CWE-368 (Context Switching Race Condition).
Critical Impact
Local privilege escalation on Android 12 through 14 devices through memory corruption, achievable without user interaction.
Affected Products
- Google Android 12.0 and 12.1
- Google Android 13.0
- Google Android 14.0
Discovery Timeline
- 2024-08-15 - CVE-2024-34731 published to NVD
- 2024-08-01 - Google releases patches in the Android Security Bulletin
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-34731
Vulnerability Analysis
The flaw lives in the Android media transcoding service, specifically the TranscodingResourcePolicy component within frameworks/av. This component tracks resource availability for hardware-backed media transcoding sessions and interacts with the ResourceManagerService. Because multiple functions in TranscodingResourcePolicy.cpp access shared state without adequate synchronization, concurrent callers can trigger inconsistent object state. The race window enables memory corruption that an attacker can shape into a control-flow primitive. Successful exploitation yields code execution in the context of the vulnerable media process, which holds privileges beyond a standard third-party application sandbox.
Root Cause
The root cause is improper locking around shared members of TranscodingResourcePolicy objects. Callback dispatch, resource reclamation, and policy teardown paths can execute concurrently on different threads. When one thread frees or reassigns a shared pointer while another dereferences it, the resulting use-after-free or torn read corrupts memory. Both CWE-362 and CWE-368 apply: the underlying defect is shared-resource synchronization, and the exploitation path relies on context switching between cooperating threads.
Attack Vector
A local, low-privileged application on the device is sufficient to reach the vulnerable code. The attacker invokes transcoding-related APIs repeatedly while triggering resource reclamation events to widen the race window. Because the CVSS vector reports high attack complexity, reliable exploitation requires precise timing between threads. No user interaction and no additional privileges are required once the malicious application is running. Refer to the Android Security Bulletin – August 2024 and the upstream fix in platform/frameworks/av for the corrected synchronization logic.
Detection Methods for CVE-2024-34731
Indicators of Compromise
- Unexpected crashes or tombstones referencing TranscodingResourcePolicy, MediaTranscodingService, or libmediatranscoding in /data/tombstones/.
- SELinux avc denials or repeated abnormal terminations of the mediatranscoding process in logcat.
- Installed applications repeatedly invoking MediaTranscodingManager APIs with rapid session creation and cancellation patterns.
Detection Strategies
- Inventory Android fleet build fingerprints and flag devices whose security patch level is earlier than 2024-08-01.
- Hunt for tombstones and native crash signatures that reference the transcoding resource policy code path.
- Correlate mobile device management (MDM) telemetry to identify sideloaded or newly installed apps that request media transcoding APIs on unpatched devices.
Monitoring Recommendations
- Forward Android device logs and crash dumps into a central data lake and alert on repeated crashes of mediatranscoding on out-of-date builds.
- Track installed application privileges and API usage through mobile threat defense agents to spot abnormal media-framework activity.
- Monitor MDM compliance reports for devices that fall behind the August 2024 Android security patch level.
How to Mitigate CVE-2024-34731
Immediate Actions Required
- Apply the August 2024 Android security patch level (2024-08-01 or later) to all managed Android 12, 12L, 13, and 14 devices.
- Enforce MDM policies that block enrollment or restrict access for devices below the patched security patch level.
- Remove untrusted or sideloaded applications on devices that cannot yet be updated.
Patch Information
Google published fixes across several Android platform repositories, including platform/frameworks/av, platform/hardware/interfaces, platform/system/nfc, and platform/system/security. The remediation for the TranscodingResourcePolicy race is tracked in the frameworks/av commit 4b68b00. Consult the Android Security Bulletin – August 2024 and OEM advisories for device-specific rollout dates.
Workarounds
- Restrict installation of unvetted applications through Google Play Protect enforcement and MDM allow-listing until patches are deployed.
- Disable or limit access to media transcoding features for high-risk user groups where operationally feasible.
- Isolate unpatched devices from sensitive corporate resources using conditional access based on device patch level.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
