CVE-2024-47038 Overview
CVE-2024-47038 is an out-of-bounds write vulnerability in the dhd_prot_flowrings_pool_release function of dhd_msgbuf.c, a component of the Broadcom DHD (Dongle Host Driver) Wi-Fi driver used in Google Android devices. The flaw stems from a missing bounds check that allows writing beyond the allocated buffer. Successful exploitation can result in local privilege escalation without requiring additional execution privileges or user interaction. Google addressed the issue in the November 2024 Android Security Bulletin for Pixel devices. The vulnerability is tracked under [CWE-787: Out-of-bounds Write].
Critical Impact
Local attackers can achieve privilege escalation on affected Android devices through an out-of-bounds write in the Wi-Fi driver, with no user interaction required.
Affected Products
- Google Android (Pixel devices, per the November 2024 Pixel Security Bulletin)
- Devices using the Broadcom DHD Wi-Fi driver containing the vulnerable dhd_msgbuf.c code
- Android kernel components shipping dhd_prot_flowrings_pool_release
Discovery Timeline
- 2024-11-01 - Google releases the Pixel Security Bulletin addressing the issue
- 2024-12-18 - CVE-2024-47038 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-47038
Vulnerability Analysis
The vulnerability resides in the dhd_prot_flowrings_pool_release routine within dhd_msgbuf.c, part of the Broadcom DHD Wi-Fi driver. This function manages the release of flowring pool resources used by the messaging buffer protocol between the host and the Wi-Fi dongle. The routine omits a required bounds check before performing a write operation, which permits memory corruption beyond the intended buffer boundary.
Flowrings are circular buffers that coordinate packet transmission between host driver and firmware. Releasing these pools without validating index or size parameters allows adjacent kernel memory to be overwritten. An attacker with local code execution on the device can trigger the vulnerable path through crafted driver interactions to corrupt kernel data structures.
Because the flaw is in kernel-resident driver code, successful exploitation yields kernel-level write primitives that translate into privilege escalation. The issue is categorized under [CWE-787] and falls into the Out-of-Bounds Write class of memory corruption vulnerabilities.
Root Cause
The root cause is a missing bounds check in dhd_prot_flowrings_pool_release. The function writes to a flowring pool structure without verifying that the target index or length stays within the allocated region, enabling an attacker-controlled write outside the buffer.
Attack Vector
Exploitation requires local access to a vulnerable Android device with the ability to interact with the affected driver interface. No user interaction is required. An attacker leveraging an unprivileged application or another foothold can invoke the vulnerable code path to corrupt kernel memory and escalate privileges.
No public proof-of-concept code or verified exploit examples are available. Technical details are limited to the description in the Android Security Bulletin November 2024.
Detection Methods for CVE-2024-47038
Indicators of Compromise
- Unexpected kernel panics or crashes referencing dhd_msgbuf or dhd_prot_flowrings_pool_release in logcat or dmesg output
- Anomalous SELinux denials originating from unprivileged processes interacting with Wi-Fi driver interfaces
- Installation of unverified APKs that request low-level Wi-Fi or networking access
- Devices running Android builds predating the November 2024 security patch level
Detection Strategies
- Inventory devices by Android security patch level and flag any device older than 2024-11-01
- Monitor mobile device management (MDM) telemetry for build fingerprints that have not received the November 2024 patch
- Review crash reports for kernel oops signatures referencing the DHD driver
Monitoring Recommendations
- Enable centralized mobile threat defense (MTD) telemetry collection for Android fleets
- Correlate Android patch level with vulnerability exposure in asset management systems
- Audit sideloaded applications and apps requesting privileged networking permissions
How to Mitigate CVE-2024-47038
Immediate Actions Required
- Apply the Android security patch level 2024-11-05 or later on all Pixel and affected Android devices
- Enforce minimum patch level requirements through MDM policy for corporate-managed devices
- Restrict installation of untrusted applications to reduce local attack surface
- Prioritize remediation on devices used by privileged users and those handling sensitive data
Patch Information
Google published the fix in the November 2024 Pixel Security Bulletin. Refer to the Android Security Bulletin November 2024 for device-specific patch availability and OTA update guidance. Original equipment manufacturers (OEMs) using the Broadcom DHD driver should incorporate the upstream fix into their own security maintenance releases.
Workarounds
- No vendor-supplied workaround exists; patching is the only supported remediation
- Disable Wi-Fi on unpatched devices when not required to reduce driver attack surface
- Block installation of unknown sources via MDM configuration until patches are deployed
# Verify Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output for remediated devices: 2024-11-05 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
