Google Fixes Two Pixel Zero-Days Exploited by Forensic Firms – Source: www.databreachtoday.com

Bugs Allowed Device Unlocking and Memory Access

Mihir Bagwe (MihirBagwe) •
April 4, 2024    

Google addressed two zero-day vulnerabilities in Pixel mobile phones that forensic firms exploited to bypass PINs and access stored data on the device.

See Also: The Death of Network Hardware Appliances

Google’s premium Pixel mobile phone runs on the tech giant’s Android operating system. In an April security bulletin, Google disclosed active exploitation of two vulnerabilities: CVE-2024-29745, an information disclosure flaw in the Pixel’s bootloader, and CVE-2024-29748, an elevation of privilege bug in the Pixel firmware.

In the terse security bulletin, Google warned, “There are indications that the following may be under limited, targeted exploitation.”

Security researchers at open-source privacy and security-focused mobile operating system GrapheneOS said that forensic companies actively exploit the flaws, allowing them to unlock and access Pixel’s device memory with physical access.

The company described CVE-2024-29745 as a bug in the fastboot firmware used to support unlocking, flashing and locking the Pixel devices. “Forensic companies are rebooting devices in After First Unlock state into fastboot mode on Pixels and other devices to exploit vulnerabilities there and then dump memory,” it said.

Google fixed the issue by zeroing memory during fastboot mode boot-up and enabling USB connectivity only after completing the zeroing process. This remediation essentially blocked and wiped out the whole class of attacks, GrapheneOS said.

The second bug, CVE-2024-29748, allows local attackers to bypass factory resets initiated by apps using the device admin API, GrapheneOS said. This makes such resets insecure. Google’s current fix for the vulnerability is “a partial solution in firmware,” since cutting power to the device can halt the wipe process.

GrapheneOS reported the two flaws a few months ago and received a collective bounty of $8,000.

The April 2024 security update for Pixel phones addresses 24 other vulnerabilities, including CVE-2024-29740, a critically rated elevation of privilege flaw that affects the ACPM subcomponent in Pixel.