cbcvebase.
CVE-2024-29745
published 2024-04-05

CVE-2024-29745: there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges…

PriorityP279medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
KEVITW
CISA Known Exploited Vulnerabilitydue 2024-04-25
Exploited in the wild
EPSS
0.48%
38.0th percentile
there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected

1 ranges
VendorProductVersion rangeFixed in
googleandroid——

Detection & IOCsextracted from sources · hover to see the quote

  • →CVE-2024-29745 is exploited via the fastboot firmware interface on Android Pixel devices; monitor for unauthorized fastboot mode access or USB debugging activity on confiscated/targeted devices ↗
  • →CVE-2024-29745 is paired with CVE-2024-29748 in active in-the-wild exploitation campaigns; detections should consider both CVEs together as a combined exploitation chain ↗
  • ·The vulnerability is in the fastboot firmware specifically, not the main Android OS runtime; patches are device-specific to Android Pixel and were released in the April 2024 Pixel security bulletin ↗
  • ·Exploitation requires no additional execution privileges and no user interaction, making it particularly dangerous for physically accessed (e.g., confiscated) devices ↗

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
vulncheck5.5MEDIUM
cisa5.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.