Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2024-29780: HWBCC Uninitialized Data Disclosure in Ubuntu
CVE-2024-29780 · published 2 years ago
Summary
An issue in HWBCC, a component of Ubuntu, may allow an attacker to access sensitive information on a local system without needing additional permissions. This can happen automatically, without any user interaction. It's recommended to update to the latest version of Ubuntu to fix this issue.
What to do
- Update google :unknown: to version Pixel-family specific:2024-06-05.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Android | :unknown: |
>= Pixel-family specific:0, < Pixel-family specific:2024-06-05 Fix: upgrade to Pixel-family specific:2024-06-05
|
|
| – | android |
All versions
cpe:2.3:o:google:android:-:*:*:*:*:*:*:* |
Original advisory text
In hwbcc_ns_deprivilege of trusty/user/base/lib/hwbcc/client/hwbcc.c, there is a possible uninitialized stack data disclosure due to uninitialized data. This could lead to local information disclos...
In hwbcc_ns_deprivilege of trusty/user/base/lib/hwbcc/client/hwbcc.c, there is a possible uninitialized stack data disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
References
- https://source.android.com/security/bulletin/pixel/2024-06-01 Vendor Advisory
- https://source.android.com/security/bulletin/2024-06-01 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
5.5
Medium
Type
CWE-908Use of Uninitialized Resource
Timeline
Published1 Jun 2024
Updated30 Sep 2026
First seen19 May 2026
Track software like this
Free during beta