Google Pixel Firmware Information Disclosure Vulnerability due to Uninitialized Data (CVE-2024-29745)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2024-29745) is an information disclosure flaw residing in the firmware and kernel components of Google Pixel devices. The root cause of this vulnerability is the presence of uninitialized data (CWE-908) during memory allocation processes. When memory buffers are reused without being properly zeroed out or initialized, residual data from previously executed processes remains in memory and becomes accessible to lower-privileged user-space applications.

2. Exploitation Mechanics & Attack Scenario

A local attacker with basic execution privileges can trigger specific system calls or API requests to force the allocation and return of uninitialized kernel/firmware memory buffers. This attack requires zero user interaction. By reading the uninitialized buffer, the attacker can extract sensitive remnants of prior operations, such as kernel pointers, memory addresses, or cryptographic keys. This leaked information can be leveraged to bypass modern exploit mitigation techniques like ASLR, facilitating subsequent Local Privilege Escalation (LPE) attacks.

3. Infrastructure & Business Impact

This vulnerability has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. In an enterprise environment, if an employee's mobile device is compromised via this vulnerability, malicious local applications can harvest sensitive corporate data, session tokens, and credentials, leading to severe data breaches and unauthorized infrastructure access.