CVE-2024-47039

In isSlotMarkedSuccessful of BootControl.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS

No CVSS.

References

Link	Resource
https://source.android.com/security/bulletin/pixel/2024-11-01

Configurations

No configuration.

History

18 Dec 2024, 19:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-12-18 19:15

Updated : 2024-12-18 19:15

NVD link : CVE-2024-47039

Mitre link : CVE-2024-47039

CVE.ORG link : CVE-2024-47039

JSON object : View

Products Affected

No product.

CWE

CWE-125

Out-of-bounds Read

Show plain JSON

{"id": "CVE-2024-47039", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "dsap-vuln-management@google.com", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 10.0, "automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "HIGH", "vulnerableSystemIntegrity": "HIGH", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "HIGH", "vulnerableSystemAvailability": "HIGH", "subsequentSystemConfidentiality": "HIGH", "vulnerableSystemConfidentiality": "HIGH", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-12-18T19:15:10.850", "references": [{"url": "https://source.android.com/security/bulletin/pixel/2024-11-01", "source": "dsap-vuln-management@google.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "dsap-vuln-management@google.com", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "In isSlotMarkedSuccessful of BootControl.cpp, there is a possible out of\u00a0bounds read due to a missing bounds check. This could lead to local\u00a0 information disclosure with no additional execution privileges needed. User\u00a0 interaction is not needed for exploitation."}, {"lang": "es", "value": "En isSlotMarkedSuccessful de BootControl.cpp, existe una posible lectura fuera de los l\u00edmites debido a una verificaci\u00f3n de los l\u00edmites faltante. Esto podr\u00eda provocar la divulgaci\u00f3n de informaci\u00f3n local sin necesidad de privilegios de ejecuci\u00f3n adicionales. No se necesita la interacci\u00f3n del usuario para la explotaci\u00f3n."}], "lastModified": "2024-12-18T19:15:10.850", "sourceIdentifier": "dsap-vuln-management@google.com"}

{

id : CVE-2024-47039 (string)

cveTags : [ *empty* ]

metrics : { »

cvssMetricV40 : [ »

0 : { »

type : Secondary (string)

source : dsap-vuln-management@google.com (string)

cvssData : { »

safety : NOT_DEFINED (string)

version : 4.0 (string)

recovery : NOT_DEFINED (string)

baseScore : 10 (number)

automatable : NOT_DEFINED (string)

attackVector : NETWORK (string)

baseSeverity : CRITICAL (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (string)

exploitMaturity : NOT_DEFINED (string)

providerUrgency : NOT_DEFINED (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

attackRequirements : NONE (string)

privilegesRequired : NONE (string)

modifiedAttackVector : NOT_DEFINED (string)

integrityRequirements : NOT_DEFINED (string)

modifiedUserInteraction : NOT_DEFINED (string)

availabilityRequirements : NOT_DEFINED (string)

modifiedAttackComplexity : NOT_DEFINED (string)

subsequentSystemIntegrity : HIGH (string)

vulnerableSystemIntegrity : HIGH (string)

modifiedAttackRequirements : NOT_DEFINED (string)

modifiedPrivilegesRequired : NOT_DEFINED (string)

confidentialityRequirements : NOT_DEFINED (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

subsequentSystemAvailability : HIGH (string)

vulnerableSystemAvailability : HIGH (string)

subsequentSystemConfidentiality : HIGH (string)

vulnerableSystemConfidentiality : HIGH (string)

modifiedSubsequentSystemIntegrity : NOT_DEFINED (string)

modifiedVulnerableSystemIntegrity : NOT_DEFINED (string)

modifiedSubsequentSystemAvailability : NOT_DEFINED (string)

modifiedVulnerableSystemAvailability : NOT_DEFINED (string)

modifiedSubsequentSystemConfidentiality : NOT_DEFINED (string)

modifiedVulnerableSystemConfidentiality : NOT_DEFINED (string)

}

]

}

published : 2024-12-18T19:15:10.850 (string)

references : [ »

0 : { »

url : https://source.android.com/security/bulletin/pixel/2024-11-01 (string)

source : dsap-vuln-management@google.com (string)

}

]

vulnStatus : Awaiting Analysis (string)

weaknesses : [ »

0 : { »

type : Secondary (string)

source : dsap-vuln-management@google.com (string)

description : [ »

0 : { »

lang : en (string)

value : CWE-125 (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : In isSlotMarkedSuccessful of BootControl.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. (string)

}

1 : { »

lang : es (string)

value : En isSlotMarkedSuccessful de BootControl.cpp, existe una posible lectura fuera de los límites debido a una verificación de los límites faltante. Esto podría provocar la divulgación de información local sin necesidad de privilegios de ejecución adicionales. No se necesita la interacción del usuario para la explotación. (string)

}

]

lastModified : 2024-12-18T19:15:10.850 (string)

sourceIdentifier : dsap-vuln-management@google.com (string)

}

CVE-2024-47039

JSON object

Attach tags to CVE-2024-47039

Attach tags to `CVE-2024-47039`