Google Warns: Android Zero-Day Flaws in Pixel Phones Exploited by Forensic Companies

Google has disclosed that two Android security flaws impacting its Pixel smartphones have been exploited in the wild by forensic companies.

The superior-severity zero-working day vulnerabilities are as follows –

• CVE-2024-29745 – An data disclosure flaw in the bootloader part
• CVE-2024-29748 – A privilege escalation flaw in the firmware ingredient

“There are indications that the [vulnerabilities] might be less than confined, specific exploitation,” Google explained in an advisory released April 2, 2024.

Though the tech big did not expose any other facts about the mother nature of the attacks exploiting these shortcomings, the maintainers of GrapheneOS mentioned they “are being actively exploited in the wild by forensic businesses.”

“CVE-2024-29745 refers to a vulnerability in the fastboot firmware made use of to guidance unlocking/flashing/locking,” they claimed in a collection of posts on X (previously Twitter).

“Forensic businesses are rebooting devices in Right after Very first Unlock point out into fastboot mode on Pixels and other products to exploit vulnerabilities there and then dump memory.”

GrapheneOS famous that CVE-2024-29748 could be weaponized by neighborhood attackers to interrupt a manufacturing unit reset induced via the machine admin API.

The disclosure comes a lot more than two months immediately after the GrapheneOS team uncovered that forensic companies are exploiting firmware vulnerabilities that influence Google Pixel and Samsung Galaxy phones to steal data and spy on customers when the product is not at rest.

It also urged Google to introduce an vehicle-reboot element to make exploitation of firmware flaws much more challenging.

Identified this posting exciting? Adhere to us on Twitter  and LinkedIn to browse additional special material we write-up.

Some parts of this article are sourced from:
thehackernews.com