Information Disclosure Vulnerability (CVE‑2024‑29745) in Android Pixel Fastboot Firmware
What It Is — Android Pixel devices contain a flaw in the fastboot firmware that can disclose sensitive information when the device is in fastboot mode. The issue stems from insufficient validation of data passed to the firmware during unlock, flash, or lock operations.
Exploitability — The vulnerability is publicly disclosed (CVE‑2024‑29745) and can be triggered by an attacker with physical or remote access to a device in fastboot mode. A CVSS score has not been published yet, but the potential for data leakage and subsequent privilege escalation classifies it as a high‑severity concern.
Affected Products — Google Pixel smartphones and tablets that ship with the vulnerable fastboot firmware (all models released prior to the vendor‑issued patch).
Why It Matters for Trust & Control Assurance
- Continuous monitoring of firmware versions is a core control‑assurance activity; missing a critical fastboot update leaves a gap in your device‑hardening posture.
- Demonstrable evidence that all endpoint firmware is up‑to‑date satisfies multiple framework objectives (e.g., asset management, vulnerability management) with a single control.
- Enterprise buyers increasingly demand audit‑ready proof that devices cannot be leveraged for data exfiltration or further compromise.
Recommended Actions
- Verify the fastboot firmware version on all Pixel devices against the vendor’s patch list.
- Deploy the latest security update from Google to remediate CVE‑2024‑29745.
- Integrate firmware‑version checks into your continuous asset‑inventory and vulnerability‑monitoring processes.
- Document remediation evidence in a centralized Trust Center for audit readiness.
Source: CISA KEV – CVE‑2024‑29745