Google Pixel Devices lwis Component Elevation of Privilege Vulnerability

A heap buffer overflow vulnerability has been identified in the lwis component of Google Pixel devices, specifically within the construct_transaction_from_cmd function of lwis_ioctl.c. This vulnerability allows for a possible out-of-bounds write, which could lead to local elevation of privilege. Exploitation of this vulnerability does not require any additional execution privileges or user interaction.

Impact

Exploitation of this vulnerability could result in unauthorized access to elevated privileges, allowing a user to perform actions or access resources that are normally restricted.

Remediation

Users can update their devices to the December 2024 security patch level to address this vulnerability.