CVE-2024-32922

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

In gpu_pm_power_on_top_nolock of pixel_gpu_power.c, there is a possible compromise of protected memory due to a logic error in the code. This could lead to local escalation of privilege to TEE with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-843

Affected software

Vendor	Product	Versions
Google	Android	Android kernel
google	android	< *
google	pixel	< *

References

https://source.android.com/security/bulletin/pixel/2024-06-01Vendor Advisory
https://source.android.com/security/bulletin/pixel/2024-06-01Vendor Advisory

Timeline

Published: Jun 13, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-329234.0there is a possible cellular denial of service due to a logic error in the code. This could lead to remote denial of service with no additio CVE-2024-329247.5In DeregAcceptProcINT of cn_NrmmStateDeregInit.cpp, there is a possible denial of service due to a logic error in the code. This could lead CVE-2024-329258.8In dhd_prot_txstatus_process of dhd_msgbuf.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remo CVE-2024-329265.5there is a possible information disclosure due to side channel information disclosure. This could lead to local information disclosure with CVE-2024-329277.8In sendDeviceState_1_6 of RadioExt.cpp, there is a possible use after free due to improper locking. This could lead to local escalation of p CVE-2024-329285.9The libcurl CURLOPT_SSL_VERIFYPEER option was disabled on a subset of requests made by Nest production devices which enabled a potential man CVE-2024-329298.1In gpu_slc_get_region of pixel_gpu_slc.c, there is a possible EoP due to a use after free. This could lead to local escalation of privilege CVE-2024-32938.8The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to blind SQL Injection via the rtmedia_gallery shortcod CVE-2024-329305.5In plugin_ipc_handler of slc_plugin.c, there is a possible information disclosure due to uninitialized data. This could lead to local inform CVE-2024-329315.7Under certain circumstances the exacqVision Web Service can expose authentication token details within communications.CVE-2024-329326.8Under certain circumstances the web interface users credentials may be recovered by an authenticated user.CVE-2024-329364.7In the Linux kernel, the following vulnerability has been resolved: media: ti: j721e-csi2rx: Fix races while restarting DMA After the fram