CVE-2024-43091 Overview
CVE-2024-43091 is an out-of-bounds write vulnerability in the filterMask function of SkEmbossMaskFilter.cpp, a component of the Skia graphics library used by Android. The flaw stems from an integer overflow [CWE-190] that allows attackers to write beyond allocated memory boundaries. Exploitation can lead to remote code execution without user interaction or additional privileges. The vulnerability affects Android versions 12.0 through 15.0 and was addressed in the November 2024 Android Security Bulletin.
Critical Impact
Remote code execution is possible on unpatched Android devices with no user interaction required, exposing billions of mobile endpoints to potential compromise through crafted graphics content.
Affected Products
- Google Android 12.0 and 12.1
- Google Android 13.0 and 14.0
- Google Android 15.0
Discovery Timeline
- 2024-11-01 - Google releases fix in Android Security Bulletin November 2024
- 2024-11-13 - CVE-2024-43091 published to NVD
- 2024-12-17 - Last updated in NVD database
Technical Details for CVE-2024-43091
Vulnerability Analysis
The vulnerability resides in the filterMask function inside SkEmbossMaskFilter.cpp, part of the Skia 2D graphics library bundled with Android. Skia processes vector graphics, fonts, and image effects across the Android rendering pipeline. The SkEmbossMaskFilter class applies emboss-style lighting effects to alpha masks during rasterization.
An integer overflow occurs when the filter computes size or offset values from attacker-controlled dimensions. The overflowed value bypasses bounds checks and is used as an index or length in a subsequent write operation. The result is an out-of-bounds write into adjacent memory regions, which attackers can leverage to corrupt heap metadata or function pointers and ultimately achieve arbitrary code execution.
Because Skia processes untrusted graphics data from many sources — web pages, messaging attachments, media files, and remote content — the attack surface is broad and reachable over the network.
Root Cause
The root cause is unchecked arithmetic on integer values used to calculate buffer sizes inside filterMask. When the computed size wraps around due to an integer overflow [CWE-190], the allocation is smaller than the data subsequently written, producing an out-of-bounds write. The upstream Skia patch is referenced in the Google Skia Code Update.
Attack Vector
Attackers deliver a crafted image, font, or rendering payload that triggers the emboss mask filter with malicious dimensions. Delivery vectors include malicious web pages rendered by Chromium-based browsers, MMS or messaging payloads, email attachments, and embedded media in applications using Skia rendering. No user interaction is required beyond viewing or processing the malicious content.
The vulnerability mechanism is described in prose only; no public proof-of-concept code has been released. Refer to the Android Security Bulletin November 2024 for advisory details.
Detection Methods for CVE-2024-43091
Indicators of Compromise
- Unexpected crashes or signal SIGSEGV in processes loading the Skia library, particularly during image or graphics rendering operations.
- Anomalous native heap corruption signatures in libhwui.so or libskia.so tombstone reports.
- Outbound network connections from rendering processes shortly after parsing untrusted graphics content.
Detection Strategies
- Inventory Android devices by build fingerprint and identify endpoints running pre-November 2024 security patch levels.
- Inspect crash logs and tombstone files for repeated faults inside SkEmbossMaskFilter::filterMask.
- Use mobile threat defense telemetry to flag applications rendering malformed graphics payloads from untrusted origins.
Monitoring Recommendations
- Track the ro.build.version.security_patch property across the managed fleet and alert when it predates 2024-11-01.
- Monitor messaging and browser applications for repeated renderer crashes that may indicate exploitation attempts.
- Correlate network egress events with rendering crashes to identify post-exploitation command-and-control activity.
How to Mitigate CVE-2024-43091
Immediate Actions Required
- Apply the November 2024 Android security patch (security patch level 2024-11-05 or later) to all affected devices.
- Prioritize patching for devices that process untrusted content, including those used for web browsing and messaging.
- Restrict installation of applications from unverified sources until patches are deployed.
Patch Information
Google published the fix in the Android Security Bulletin November 2024. The upstream Skia commit is available at the Google Skia Code Update. Device manufacturers distribute the fix through their own over-the-air update channels, so patch availability varies by vendor and carrier.
Workarounds
- Avoid opening untrusted images, attachments, or links in messaging applications until patches are applied.
- Disable automatic media downloads in messaging clients such as Messages, WhatsApp, and Signal.
- Enforce mobile device management policies that require current security patch levels before granting access to corporate resources.
# Verify the Android security patch level on a managed device
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2024-11-05 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
