CVE-2024-31313 - Out-of-Bounds Write in Android MessageQueueBase.h – Local Privilege Escalation Exploit Details

In April 2024, a serious security vulnerability, CVE-2024-31313, was discovered in the Android Open Source Project (AOSP). It is found inside the availableToWriteBytes function in MessageQueueBase.h. This bug causes out-of-bounds writes when processing messages, due to an incorrect bounds check. Any attacker with local access to the device could exploit this to escalate privileges, potentially taking over your data.

This post explains the vulnerability in simple terms, shows part of the impacted source code, and provides details about how this bug might be abused. No user interaction is required for exploitation, and no additional execution privileges are needed for a successful attack.

What’s the Vulnerability?

Android has a messaging subsystem to handle communication between apps and the system itself. The MessageQueueBase class helps manage those messages. Inside it, the availableToWriteBytes function checks how much space is left to write new messages. Unfortunately, a logic error in this function can allow unchecked data to be written past the bounds of a buffer—possibly overwriting important memory.

Result: A local unprivileged attacker could run code that exploits this, escalating their privileges on the device without the user knowing.

Here’s a simplified, illustrative snippet (based on public information)

// MessageQueueBase.h
size_t availableToWriteBytes() const {
    return mBufferSize - mWriteOffset;
}

// The buggy check happens elsewhere:
if (size <= availableToWriteBytes()) {
    memcpy(mBuffer + mWriteOffset, data, size); // oops, write unchecked!
    mWriteOffset += size;
}

What’s wrong?
If either mBufferSize or mWriteOffset is corrupted or unchecked, availableToWriteBytes() will return an incorrect (even negative!) value, allowing an attacker to write data past the buffer’s real size.

Overwrite important objects or code pointers, leading to arbitrary code execution.

- Escalate their privileges on the device, potentially becoming root or gaining access to sensitive system data.

> No user interaction is required.
>
> No elevated privileges are needed to start with.

Proof of Concept: How Exploitation Works

The attack doesn't require deep privileges. For example, a malicious application could allocate a message buffer, manipulate offsets to confuse the bounds check, and trigger a write outside the buffer:

// Pseudocode for exploit
size_t size = x200; // Large value
char* evilData = createMaliciousPayload(size);

// Overwrite mWriteOffset to force overflow
victimQueue->mWriteOffset = victimQueue->mBufferSize - 1;

// Now write 'size' bytes, but only one byte is actually left in the buffer
victimQueue->write(evilData, size); // Boom! Out-of-bounds write.

*This is illustrative and not functional exploit code.*

Patches & Mitigations

Google and Android’s security team have released updates to fix the flaw by properly checking buffer boundaries and changing how offsets are validated. Devices updated with April/May 2024 security patches are protected.

Check your Android updates: Make sure your device is on the latest security patch.

- Reference patch: Android AOSP Gerrit Patch

Takeaway

CVE-2024-31313 shows how a small mistake in bounds checking can open the door for serious attacks, with no warning to users. Keeping your software updated—and understanding how such logical bugs can cause major security breaches—is vital in today’s digital world.

Stay safe: Always update your Android device and install only trusted apps.

*This article is exclusive content. All code and explanations are original, based on public advisories and disclosed technical information around CVE-2024-31313.*

Timeline

Published on: 07/09/2024 21:15:12 UTC
Last modified on: 08/01/2024 13:50:49 UTC